coverage 7.16.2

Source: https://github.com/coveragepy/coveragepy
Tag scanned: 7.16.2
Compared with: 7.16.1 (0 signals introduced since)
Files: 264 scanned, 32 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 71 info
Scan time: 34.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 43 of 43 warn and critical signals; 43 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 01:29

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution .github/workflows/python-nightly.yml:74:11

[embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
          curl -L https://github.com/pyenv/pyenv-installer/raw/master/bin/pyenv-installer | bash
```
likely benign LLM, confidence 0.75 CI step that downloads the pyenv installer from GitHub and pipes it to bash.
Reasoning
A curl-to-bash pipe is a supply-chain risk in general, but this is a nightly CI workflow fetching the official pyenv-installer from the project's GitHub repo, which is a common and legitimate setup step for testing Python versions.
info ~~warn~~ → info by review dynamic-execution coverage/bytecode.py:27:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
            assert text is not None
            code = compile(text, filename or "<string>", "exec", dont_inherit=True)
        self.code = code
```
likely benign LLM, confidence 0.90 Compiles source text into a code object for coverage analysis.
Reasoning
Compiling source text loaded from a file is how coverage.py builds code objects for analysis. The filename and mode are ordinary and the call is not obfuscated.
info ~~warn~~ → info by review frame-introspection coverage/collector.py:289:9

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
        # Remove ourselves as the trace function.
        sys.settrace(None)
        # Install the real tracer.
        fn: TTraceFn | None = self._start_tracer()
```
likely benign LLM, confidence 0.93 Clears and reinstalls the Python trace function during coverage collection.
Reasoning
sys.settrace(None) removes the tracer before reinstalling the real one. This is the core mechanism of a coverage tool, not evasion.
info ~~warn~~ → info by review frame-introspection coverage/debug.py:101:27

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
        if self.should("self"):
            caller_self = inspect.stack()[1][0].f_locals.get("self")
            if caller_self is not None:
                self.output.write(f"self: {caller_self!r}\n")
```
likely benign LLM, confidence 0.92 Inspects the caller's stack frame to log its self object in debug output.
Reasoning
Reading the caller's frame locals for debug output is a normal feature of coverage's debug tooling.
info ~~warn~~ → info by review frame-introspection coverage/debug.py:276:42

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    stack: Iterable[inspect.FrameInfo] = inspect.stack()[:skip:-1]
    if not full:
        for pat in BORING_PRELUDE:
```
likely benign LLM, confidence 0.92 Captures a filtered call stack for debug output.
Reasoning
Walking the stack to produce a trimmed debug trace is an ordinary debugging utility in coverage.py.
info ~~critical~~ → info by review frame-introspection coverage/execfile.py:115:24

`inspect.stack` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
            # don't know what's going on, and just leave it alone.
            top_file = inspect.stack()[-1][0].f_code.co_filename
            sys_path_0_abs = os.path.abspath(sys.path[0])
            top_file_dir_abs = os.path.abspath(os.path.dirname(top_file))
```
likely benign LLM, confidence 0.85 Looks up the top-level script's filename to fix up sys.path for the run command.
Reasoning
The stack lookup finds the top-level script file so coverage can set sys.path[0] for the run command. The critical rating comes from a heuristic that co-occurs with exec, but the surrounding code is ordinary path handling for running user programs.
info ~~warn~~ → info by review decoder-import-with-exec coverage/execfile.py:222:13

file imports decoder module(s) marshal and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
        try:
            exec(code, main_mod.__dict__)
        except SystemExit:  # pylint: disable=try-except-raise
            # The user called sys.exit().  Just pass it along to the upper
```
likely benign LLM, confidence 0.90 Executes the user's target program inside its main module namespace.
Reasoning
The exec runs the user's own program in its own namespace, which is the intended behavior of coverage's run command. The marshal import is for reading .pyc files and does not indicate a hidden payload.
info ~~warn~~ → info by review dynamic-execution coverage/execfile.py:222:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            exec(code, main_mod.__dict__)
        except SystemExit:  # pylint: disable=try-except-raise
            # The user called sys.exit().  Just pass it along to the upper
```
likely benign LLM, confidence 0.90 Executes the user's target program code object.
Reasoning
This is the same exec of the user's target program as the previous finding, which is the expected behavior of a run command.
info ~~warn~~ → info by review dynamic-execution coverage/execfile.py:307:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    code = compile(source, filename, mode="exec", dont_inherit=True)
    return code
```
likely benign LLM, confidence 0.90 Compiles the target program's source before execution.
Reasoning
Compiling the source of the user's target file before running it is the normal way coverage's run command loads a program.
info ~~warn~~ → info by review dynamic-execution coverage/execfile.py:335:16

`marshal.load` deserializes Python bytecode from bytes — code-object sink (ast pass, confidence 0.75)
```
        # The rest of the file is the code object we want.
        code = marshal.load(fpyc)
        assert isinstance(code, CodeType)
```
likely benign LLM, confidence 0.85 Loads a code object from a .pyc file for execution.
Reasoning
marshal.load reads a .pyc file's code object and asserts its type, which is the standard way to run cached bytecode. Nothing in the snippet suggests a hidden or fabricated payload.
info ~~warn~~ → info by review dynamic-execution coverage/parser.py:691:30

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            if node.id in ["True", "False", "None", "__debug__"]:
                return True, eval(node.id)  # pylint: disable=eval-used
        case ast.UnaryOp():
            if isinstance(node.op, ast.Not):
```
dismissed LLM, confidence 0.92 Evaluates a constant name from an AST node restricted to True, False, None or __debug__.
Reasoning
eval is applied only to the names True, False, None and __debug__, all of which are safe literal constants, and the call is annotated as a deliberate pylint exception.
info ~~critical~~ → info by review dynamic-import coverage/plugin_support.py:45:13

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            self.current_module = module
            __import__(module)
            mod = sys.modules[module]
```
likely benign LLM, confidence 0.88 Dynamically imports a coverage plugin module named in configuration.
Reasoning
Importing a module named in the user's coverage configuration is how plugins are loaded. The module name comes from configuration, not from obfuscated data.
info ~~warn~~ → info by review frame-introspection coverage/pytracer.py:171:13

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
                    f = f.f_back
            sys.settrace(None)
            try:
                self.cur_file_data, self.cur_file_name, self.last_line, self.started_context = (
```
likely benign LLM, confidence 0.93 Temporarily clears the trace function while recording coverage data.
Reasoning
Temporarily disabling the trace function while the tracer updates its own state is standard coverage tracer code.
info ~~warn~~ → info by review frame-introspection coverage/pytracer.py:337:9

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
        sys.settrace(self._cached_bound_method_trace)
        return self._cached_bound_method_trace
```
likely benign LLM, confidence 0.93 Installs the tracer's cached trace function via sys.settrace.
Reasoning
Installing the cached bound-method trace function is the core of the Python tracer and is expected behavior.
info ~~warn~~ → info by review decoder-decompress-payload coverage/sqldata.py:451:18

file imports decoder module(s) base64, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            )
        script = zlib.decompress(data[1:]).decode("utf-8")
        self._dbs[threading.get_ident()] = db = SqliteDb(self._filename, self._debug, self._no_disk)
        with db:
```
likely benign LLM, confidence 0.70 Decompresses an embedded SQL script and runs it to set up the coverage database.
Reasoning
The compressed blob is decompressed and then executed as a SQL script, which resembles a payload shape. In coverage.py it most likely holds a bundled schema or setup script for the SQLite database. The blob itself is not shown, so some doubt remains.
info ~~warn~~ → info by review frame-introspection coverage/sysmon.py:339:25

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
            if disp is None:
                frame = inspect.currentframe()
                if frame is not None:
                    frame = inspect.currentframe().f_back  # type: ignore[union-attr]
```
likely benign LLM, confidence 0.85 Coverage tool fetches the current stack frame via inspect.currentframe.
Reasoning
inspect.currentframe() is used to find the caller's frame for coverage tracing. This is standard for a coverage tool and has no sign of hiding behavior.
info ~~warn~~ → info by review frame-introspection coverage/sysmon.py:341:29

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
                if frame is not None:
                    frame = inspect.currentframe().f_back  # type: ignore[union-attr]
                    if LOG:  # pragma: debugging
                        # @panopticon adds a frame.
```
likely benign LLM, confidence 0.85 Coverage tool walks back one frame via currentframe().f_back.
Reasoning
Same legitimate frame lookup in coverage's sys.monitoring integration, with a debugging comment about frame adjustment.
info ~~warn~~ → info by review dynamic-execution coverage/templite.py:70:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        global_namespace: dict[str, Any] = {}
        exec(python_source, global_namespace)
        return global_namespace
```
likely benign LLM, confidence 0.75 Template engine executes its generated Python source in a fresh namespace.
Reasoning
Templite is a small template engine that compiles generated Python source for rendering. exec on generated code is its intended mechanism, not an attack pattern.
info ~~warn~~ → info by review unicode-zero-width doc/config.rst:419:61

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
(multi-string) A list of debug options.  See :ref:`the run -⟨U+200D⟩-debug option
<cmd_run_debug>` for details.
```
likely benign LLM, confidence 0.80 Docs text contains a ZWJ splitting the '--debug' option name.
Reasoning
A zero-width joiner inside the literal '--debug' in reST docs is most likely a typographic workaround to stop Sphinx from turning '--' into an en dash. It is not used to hide content from readers or tools.
info ~~warn~~ → info by review unicode-zero-width doc/config.rst:428:68

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
(string) A file name to write debug output to.  See :ref:`the run -⟨U+200D⟩-debug
option <cmd_run_debug>` for details.
```
likely benign LLM, confidence 0.80 Docs text contains a ZWJ splitting the '--debug' option name.
Reasoning
Same ZWJ inside the '--debug' option reference, consistent with a dash-rendering workaround in documentation prose.
info ~~warn~~ → info by review unicode-zero-width doc/config.rst:697:24

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
The ``--debug=pathmap`` option can be used to log details of the re-mapping of
paths.  See :ref:`the -⟨U+200D⟩-debug option <cmd_run_debug>`.

See :ref:`cmd_combine_remapping` and :ref:`source_glob` for more information.
```
likely benign LLM, confidence 0.80 Docs cross-reference contains a ZWJ splitting '--debug'.
Reasoning
Same ZWJ within a documentation cross-reference to the --debug option, consistent with a dash-rendering workaround.
info ~~warn~~ → info by review dynamic-execution igor.py:335:20

`subprocess.getoutput` called with a literal shell command (ast pass, confidence 0.70)
```
    facts.now = datetime.datetime.now()
    facts.branch = subprocess.getoutput("git rev-parse --abbrev-ref @")
    facts.sha = subprocess.getoutput("git rev-parse @")
    return facts
```
likely benign LLM, confidence 0.90 Developer script collects the git branch name via a literal git command.
Reasoning
Build helper runs fixed git commands to read branch metadata. The command is a literal with no untrusted input.
info ~~warn~~ → info by review dynamic-execution igor.py:336:17

`subprocess.getoutput` called with a literal shell command (ast pass, confidence 0.70)
```
    facts.branch = subprocess.getoutput("git rev-parse --abbrev-ref @")
    facts.sha = subprocess.getoutput("git rev-parse @")
    return facts
```
likely benign LLM, confidence 0.90 Developer script collects the git SHA via a literal git command.
Reasoning
Fixed literal git rev-parse call to record the commit SHA, with no external input.
info ~~warn~~ → info by review dynamic-attribute igor.py:507:19

reach-by-name through `globals.get` (ast pass, confidence 0.60)
```
        verb = args.pop(0)
        handler = globals().get("do_" + verb)
        if handler is None:
            print(f"*** No handler for {verb!r}")
```
likely benign LLM, confidence 0.85 Command-line dispatcher resolves do_<verb> handler by name.
Reasoning
Dispatches a CLI subcommand to a do_<verb> function by name. The lookup is a local command table, not a remote or hidden payload.
info dynamic-execution lab/compare_times.sh:32:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)
```
$HYPERFINE 'python -m pytest test_file1.py'

echo "Coverage 4.5.4"
```

info dynamic-execution lab/compare_times.sh:36:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

pip install -q coverage==4.5.4
$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'

info dynamic-execution lab/compare_times.sh:37:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:38:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:39:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

echo "Coverage 5.0a8, no contexts"

info dynamic-execution lab/compare_times.sh:43:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

pip install -q coverage==5.0a8
$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'

info dynamic-execution lab/compare_times.sh:44:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:45:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:46:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

echo "Coverage 5.0a8, with test contexts"

info dynamic-execution lab/compare_times.sh:54:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)


$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'

info dynamic-execution lab/compare_times.sh:55:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:56:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:57:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

echo "Pytest-cov contexts"

info dynamic-execution lab/compare_times.sh:62:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)


$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-context=test test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch --cov-context=test test_file1.py'

info dynamic-execution lab/compare_times.sh:63:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-context=test test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch --cov-context=test test_file1.py'

info ~~warn~~ → info by review dynamic-execution lab/hack_pyc.py:19:21

`marshal.load` deserializes Python bytecode from bytes — code-object sink (ast pass, confidence 0.75)
```
        self.modtime = f.read(4)
        self.code = marshal.load(f)

    def write(self, f):
```
likely benign LLM, confidence 0.70 Lab script loads bytecode objects from a .pyc file with marshal.
Reasoning
A lab utility for reading and writing .pyc files, where marshal.load is the expected way to parse bytecode. The file is a local developer tool, not a payload loader, but marshal on untrusted bytes is a known risk.
info ~~warn~~ → info by review dynamic-execution lab/parser.py:173:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    code = compile(text, "", "exec", dont_inherit=True)
    for code_obj in all_code_objects(code):
        if text:
```
likely benign LLM, confidence 0.70 Lab parser compiles source text to walk its code objects.
Reasoning
Lab parser compiles source text to inspect code objects, which fits a coverage-analysis experiment. The input is local source, not a hidden dropper.
info ~~critical~~ → info by review dynamic-execution lab/run_sysmon.py:12:8

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
code = compile(open(the_program, encoding="utf-8").read(), filename=the_program, mode="exec")

my_id = sys.monitoring.COVERAGE_ID
```
likely benign LLM, confidence 0.80 Lab runner compiles a user-specified program file for sys.monitoring.
Reasoning
A lab runner that compiles a program file named on the command line so it can run it under sys.monitoring. Executing the target is the tool's purpose, not hidden behavior.
info ~~critical~~ → info by review dynamic-execution lab/run_sysmon.py:119:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
exec(code)
```
likely benign LLM, confidence 0.80 Lab runner execs the compiled target program.
Reasoning
The module-level exec runs the program compiled from the user-specified file, which is the runner's design. It is not an obfuscated or hidden payload.
info ~~critical~~ → info by review dynamic-execution lab/run_trace.py:42:12

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
code = open(the_program, encoding="utf-8").read()
code_obj = compile(code, the_program, mode="exec")
sys.settrace(trace)
exec(code_obj)
```
likely benign LLM, confidence 0.80 Lab runner compiles the target program file for tracing.
Reasoning
A lab runner compiles a user-named program file to run under a tracer, matching its evident purpose.
info ~~critical~~ → info by review frame-introspection lab/run_trace.py:43:1

`sys.settrace` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
code_obj = compile(code, the_program, mode="exec")
sys.settrace(trace)
exec(code_obj)
```
likely benign LLM, confidence 0.80 Lab runner installs a trace function before running the target.
Reasoning
sys.settrace installs a tracer for the lab runner's target program. The anti-analysis flag is a heuristic false positive here, since tracing is the tool's purpose.
info ~~critical~~ → info by review dynamic-execution lab/run_trace.py:44:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
sys.settrace(trace)
exec(code_obj)
```
likely benign LLM, confidence 0.80 Lab runner execs the traced target program.
Reasoning
Module-level exec of the compiled target program is the runner's core function, with no sign of concealment.
info ~~warn~~ → info by review dynamic-execution lab/show_pyc.py:42:12

`marshal.load` deserializes Python bytecode from bytes — code-object sink (ast pass, confidence 0.75)
```
        print("pysize %s (%d)" % (binascii.hexlify(size), struct.unpack("<L", size)[0]))
    code = marshal.load(f)
    show_code(code)
```
likely benign LLM, confidence 0.80 Reads a compiled Python bytecode file with marshal to display its code object.
Reasoning
marshal.load on a .pyc file handle is the standard way to read compiled code objects. The file is in a lab directory and the surrounding code only prints sizes and shows the code object, so this looks like a bytecode inspection utility rather than a dropper.
info ~~warn~~ → info by review decoder-import-with-exec lab/show_pyc.py:52:12

file imports decoder module(s) binascii, marshal and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
def show_py_text(text, fname="<string>"):
    code = compile(text, fname, "exec", dont_inherit=True)
    show_code(code)
```
likely benign LLM, confidence 0.80 Helper that compiles Python source text and passes the code object to a display function.
Reasoning
The file combines marshal and binascii with compile(), but the snippet is a helper that compiles source text and passes the code object to show_code, which displays it. The pattern matches a disassembler and does not execute the result.
info ~~warn~~ → info by review dynamic-execution lab/show_pyc.py:52:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
def show_py_text(text, fname="<string>"):
    code = compile(text, fname, "exec", dont_inherit=True)
    show_code(code)
```
likely benign LLM, confidence 0.80 compile() applied to a function argument in a bytecode display helper.
Reasoning
compile() on a caller-supplied text argument is expected in a bytecode viewer. The code object is only shown, not run, so the non-literal input is not by itself evidence of malice.
info ~~warn~~ → info by review dynamic-execution setup.py:31:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        # Execute the code in version.py.
        exec(compile(version_file.read(), cov_ver_py, "exec", dont_inherit=True), module_globals)
    return module_globals
```
likely benign LLM, confidence 0.90 Executes the contents of the project's version.py to obtain version metadata at build time.
Reasoning
This is the common coverage.py idiom for reading version.py into a module globals dict during setup. The source is a fixed local file, not network or encoded data.
info ~~warn~~ → info by review dynamic-execution setup.py:31:14

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        # Execute the code in version.py.
        exec(compile(version_file.read(), cov_ver_py, "exec", dont_inherit=True), module_globals)
    return module_globals
```
likely benign LLM, confidence 0.90 Compiles the project's version.py source before exec-ing it for version metadata.
Reasoning
The compile call is the compile half of the same exec(compile(...)) version-loading idiom. It reads a fixed project file with a fixed filename.
info ~~critical~~ → info by review dynamic-execution tests/helpers.py:63:12

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
    proc = subprocess.Popen(
        cmd,
        shell=True,
```
likely benign LLM, confidence 0.70 Test helper that runs a caller-supplied command string through a shell.
Reasoning
Test helpers commonly run shell command strings passed in by test code, so shell=True with a variable command is expected here. The critical severity reflects the pattern alone. Nothing in the snippet shows a hidden or remote command source, but the command's origin is not visible.
info ~~warn~~ → info by review dynamic-execution tests/test_arcs.py:2456:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
            """)
        code_obj = compile(code, filename="hello.html", mode="exec")
        cov = coverage.Coverage(branch=True, debug=["trace"])
        with cov.collect():
```
likely benign LLM, confidence 0.90 Compiles an inline test code string to run under coverage.
Reasoning
This is a test that compiles a hard-coded source snippet with a fixed filename to exercise coverage tracing. It is ordinary test setup.
info ~~warn~~ → info by review dynamic-execution tests/test_arcs.py:2459:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        with cov.collect():
            exec(code_obj)
```
likely benign LLM, confidence 0.90 Executes the test's compiled code object under coverage collection.
Reasoning
exec of the compiled test code object inside a coverage collection block is the intended behavior of this test. The code comes from the test file itself.
info ~~warn~~ → info by review dynamic-execution tests/test_cmdline.py:195:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        globs = {n: getattr(expected, n) for n in self.MOCK_GLOBALS}
        code_obj = compile(code, "<code>", "exec", dont_inherit=True)
        eval(code_obj, globs, {})  # pylint: disable=eval-used
```
likely benign LLM, confidence 0.90 Compiles a test code string with a fixed filename for command-line testing.
Reasoning
The test compiles a fixed code string taken from the test's own data to check command-line behavior. It is ordinary test scaffolding.
info ~~warn~~ → info by review dynamic-execution tests/test_cmdline.py:196:9

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        code_obj = compile(code, "<code>", "exec", dont_inherit=True)
        eval(code_obj, globs, {})  # pylint: disable=eval-used

        # Many of our functions take a lot of arguments, and cmdline.py
```
likely benign LLM, confidence 0.90 Evaluates the compiled test code with mock globals.
Reasoning
eval of the compiled code object with a test-controlled globals dict is a deliberate test technique, marked with a pylint disable. The source is not external.

info unicode-mixed-script tests/test_config.py:95:33

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

            [tool.coverage.html]
            title = "tabblo & «ταБЬℓσ»"
            [tool.coverage.plugins.a_plugin]
            hello = "world"

info unicode-mixed-script tests/test_config.py:107:53

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        assert cov.config.precision == 3
        assert cov.config.html_title == "tabblo & «ταБЬℓσ»"
        assert cov.config.fail_under == 90.5
        assert cov.config.get_plugin_options("plugins.a_plugin") == {"hello": "world"}

info unicode-mixed-script tests/test_config.py:948:32

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)
```
            [html]
            title = tabblo & «ταБЬℓσ» # numbers
            """,
        )
```

info unicode-mixed-script tests/test_config.py:955:53

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        assert cov.config.exclude_list == ["first", "✘weirdo", "third"]
        assert cov.config.html_title == "tabblo & «ταБЬℓσ» # numbers"

    @pytest.mark.parametrize("bad_file", ["nosuchfile.txt", "."])

info ~~warn~~ → info by review frame-introspection tests/test_context.py:243:13

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """Helper to return qualname_from_frame for the caller."""
    stack = inspect.stack()[1:]
    if any(sinfo[0].f_code.co_name == "get_qualname" for sinfo in stack):
        # We're calling ourselves recursively, maybe because we're testing
```
likely benign LLM, confidence 0.90 Reads the call stack to detect recursive get_qualname calls in a test helper.
Reasoning
inspect.stack is used to find recursive calls when computing a qualified name in a test helper. This is standard introspection with no concealment.

info unicode-mixed-script tests/test_html.py:450:58

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        self.create_initial_files()
        self.make_file(".coveragerc", "[html]\ntitle = «ταБЬℓσ» numbers")
        self.run_coverage()
        index = self.get_html_index_content()

info unicode-mixed-script tests/test_html.py:459:50

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        self.make_file(".coveragerc", "[html]\ntitle = Good title\n")
        self.run_coverage(htmlargs=dict(title="«ταБЬℓσ» & stüff!"))
        index = self.get_html_index_content()
        expected = (

info unicode-mixed-script tests/test_html.py:1402:28

identifier `ʎd` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)


            upside_down = "ʎd˙ǝbɐɹǝʌoɔ"
            surrogate = "db40,dd00: x@"
            """.replace("@", surrogate),

info unicode-mixed-script tests/test_html.py:1402:33

identifier `ǝbɐɹǝʌoɔ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)


            upside_down = "ʎd˙ǝbɐɹǝʌoɔ"
            surrogate = "db40,dd00: x@"
            """.replace("@", surrogate),

info unicode-mixed-script tests/test_mixins.py:54:49

identifier `ταБℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

    def test_make_file_non_ascii(self) -> None:
        self.make_file("unicode.txt", "tablo: «ταБℓσ»")
        with open("unicode.txt", "rb") as f:
            text = f.read()

info ~~critical~~ → info by review dynamic-import tests/test_python.py:40:15

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
        # Run the code to see that we really got it encoded properly.
        mod = __import__("encoded_" + encoding)
        assert mod.encoding == encoding
```
likely benign LLM, confidence 0.85 Dynamically imports a test module named by source encoding to verify it decodes correctly.
Reasoning
The test imports a module named encoded_ plus an encoding name, which matches the test's purpose of checking source-encoding handling. The module name comes from a test-defined list, not from an outside source.

info unicode-mixed-script tests/test_templite.py:325:24

identifier `ollǝɥ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

        self.try_render(
            "{{where}} ollǝɥ",
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",

info unicode-mixed-script tests/test_templite.py:326:24

identifier `ǝɹǝɥʇ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

            "{{where}} ollǝɥ",
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",
        )

info unicode-mixed-script tests/test_templite.py:327:14

identifier `ǝɹǝɥʇ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",
        )
```
info unicode-mixed-script tests/test_templite.py:327:25

identifier `ollǝɥ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",
        )
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/coveragepy/coveragepy coveragepy && cd coveragepy
git checkout 7.16.2
disclude scan --severity info --diff 7.16.1 .