coverage 7.17.0

Source: https://github.com/coveragepy/coveragepy
Tag scanned: 7.17.0
Compared with: 7.16.2 (2 signals introduced since)
Files: 272 scanned, 34 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 1 warn · 70 info
Scan time: 38.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 43 of 43 warn and critical signals; 42 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 18:44

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn decoder-decompress-payload coverage/sqldata.py:465:18

file imports decoder module(s) base64, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            )
        script = zlib.decompress(data[1:]).decode("utf-8")
        self._dbs[threading.get_ident()] = db = SqliteDb(self._filename, self._debug, self._no_disk)
        with db:
```
likely benign LLM, confidence 0.60 Decompresses a stored SQL script for a coverage database.
Reasoning
zlib decompression of data with a leading flag byte and then decoding it as a script looks like a serialized SQL dump format. The snippet does not show where the bytes come from, but in coverage.py this pattern appears in its own data-file serialization. Some doubt remains because the decoded script is executed.
info ~~warn~~ → info by review frame-introspection coverage/debug.py:101:27 new in this release

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
        if self.should("self"):
            caller_self = inspect.stack()[1].frame.f_locals.get("self")
            if caller_self is not None:
                self.output.write(f"self: {caller_self!r}\n")
```
likely benign LLM, confidence 0.95 Reads the caller's self attribute for debug logging.
Reasoning
inspect.stack is used for debug output of the caller's self object in coverage's debug facility. This is ordinary introspection for diagnostics.
info ~~critical~~ → info by review frame-introspection coverage/execfile.py:111:24 new in this release

`inspect.stack` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
            # don't know what's going on, and just leave it alone.
            top_file = inspect.stack()[-1].frame.f_code.co_filename
            sys_path_0_abs = os.path.abspath(sys.path[0])
            top_file_dir_abs = os.path.abspath(os.path.dirname(top_file))
```
likely benign LLM, confidence 0.90 Uses the stack to find the top-level script path before running the user's program.
Reasoning
The critical severity comes from the anti-analysis heuristic, since the file also calls sys.exit and exec. Here inspect.stack finds the top-level script file so coverage can run it with the correct sys.path. The exec and exit calls are how coverage runs user programs, so the combination is expected.
info ~~warn~~ → info by review dynamic-execution .github/workflows/python-nightly.yml:74:11

[embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
          curl -L https://github.com/pyenv/pyenv-installer/raw/master/bin/pyenv-installer | bash
```
likely benign LLM, confidence 0.80 CI step that downloads the pyenv installer from GitHub and runs it with bash.
Reasoning
A CI workflow pipes the official pyenv-installer from GitHub into bash. Piping a remote script to a shell is risky in general, but this is a well-known, pinned-upstream bootstrap pattern in a nightly Python build workflow, not obfuscation.
info ~~warn~~ → info by review dynamic-execution coverage/bytecode.py:27:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
            assert text is not None
            code = compile(text, filename or "<string>", "exec", dont_inherit=True)
        self.code = code
```
likely benign LLM, confidence 0.90 Compiles source text read from a file to build a code object for coverage analysis.
Reasoning
Coverage.py compiles source text it has loaded, which is its core function for analysing code. The compile call is expected in this context.
info ~~warn~~ → info by review frame-introspection coverage/collector.py:289:9

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
        # Remove ourselves as the trace function.
        sys.settrace(None)
        # Install the real tracer.
        fn: TTraceFn | None = self._start_tracer()
```
likely benign LLM, confidence 0.95 Clears and reinstalls the coverage trace function.
Reasoning
Calling sys.settrace(None) to remove the coverage trace function before installing the real tracer is standard coverage.py behaviour.
info ~~warn~~ → info by review frame-introspection coverage/debug.py:276:42

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    stack: Iterable[inspect.FrameInfo] = inspect.stack()[:skip:-1]
    if not full:
        for pat in BORING_PRELUDE:
```
likely benign LLM, confidence 0.95 Collects the call stack to print in debug output.
Reasoning
inspect.stack is used to build a filtered call stack for debug output, which fits coverage's debug module.
info ~~warn~~ → info by review decoder-import-with-exec coverage/execfile.py:218:13

file imports decoder module(s) marshal and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
        try:
            exec(code, main_mod.__dict__)
        except SystemExit:  # pylint: disable=try-except-raise
            # The user called sys.exit().  Just pass it along to the upper
```
likely benign LLM, confidence 0.90 Runs the target program's code in the main module namespace.
Reasoning
Executing the user's program code in its own __main__ namespace is the purpose of coverage's run command. The import-of-marshal heuristic matches normal execfile behaviour.
info ~~warn~~ → info by review dynamic-execution coverage/execfile.py:218:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            exec(code, main_mod.__dict__)
        except SystemExit:  # pylint: disable=try-except-raise
            # The user called sys.exit().  Just pass it along to the upper
```
likely benign LLM, confidence 0.90 Executes the program code being measured.
Reasoning
This is the same exec of the user's program code as the previous finding, which is the expected function of a program runner.
info ~~warn~~ → info by review dynamic-execution coverage/execfile.py:303:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    code = compile(source, filename, mode="exec", dont_inherit=True)
    return code
```
likely benign LLM, confidence 0.90 Compiles source of the program being run.
Reasoning
Compiling the source of the user's program with dont_inherit is standard for a runner like coverage.
info ~~warn~~ → info by review dynamic-execution coverage/execfile.py:331:16

`marshal.load` deserializes Python bytecode from bytes — code-object sink (ast pass, confidence 0.75)
```
        # The rest of the file is the code object we want.
        code = marshal.load(fpyc)
        assert isinstance(code, CodeType)
```
likely benign LLM, confidence 0.80 Loads a code object from a local .pyc file for execution.
Reasoning
marshal.load reads a code object from a local .pyc file the user asked to run, which is how coverage handles running compiled files. It is not a payload fetched from the network or hidden in an encoded blob, and the result is checked to be a CodeType.
info ~~warn~~ → info by review dynamic-execution coverage/parser.py:673:30

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            if node.id in ["True", "False", "None", "__debug__"]:
                return True, eval(node.id)  # pylint: disable=eval-used
        case ast.UnaryOp():
            if isinstance(node.op, ast.Not):
```
dismissed LLM, confidence 0.90 Evaluates Python constant names during AST analysis.
Reasoning
The eval only runs on the literal names True, False, None and __debug__ that were matched immediately before. It is a constant lookup, not an arbitrary evaluation.
info ~~critical~~ → info by review dynamic-import coverage/plugin_support.py:45:13

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            self.current_module = module
            __import__(module)
            mod = sys.modules[module]
```
likely benign LLM, confidence 0.85 Imports a configured coverage plugin module by name.
Reasoning
Dynamic import of a plugin module named in coverage configuration is the designed plugin mechanism. The module name comes from the user's own config.
info ~~warn~~ → info by review frame-introspection coverage/pytracer.py:171:13

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
                    f = f.f_back
            sys.settrace(None)
            try:
                self.cur_file_data, self.cur_file_name, self.last_line, self.started_context = (
```
likely benign LLM, confidence 0.95 Temporarily disables the Python trace function.
Reasoning
Pausing the trace function with sys.settrace(None) while handling tracer state is normal for a Python tracer.
info ~~warn~~ → info by review frame-introspection coverage/pytracer.py:337:9

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
        sys.settrace(self._cached_bound_method_trace)
        return self._cached_bound_method_trace
```
likely benign LLM, confidence 0.95 Installs the coverage tracer function.
Reasoning
Installing the cached bound trace method via sys.settrace is the core operation of coverage's Python tracer.
info ~~warn~~ → info by review frame-introspection coverage/sysmon.py:339:25

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
            if disp is None:
                frame = inspect.currentframe()
                if frame is not None:
                    frame = inspect.currentframe().f_back  # type: ignore[union-attr]
```
likely benign LLM, confidence 0.95 Uses inspect.currentframe to locate the caller frame in the coverage tracer.
Reasoning
Standard frame lookup in coverage.py's sys.monitoring tracer to find the calling frame. Routine for a coverage library.
info ~~warn~~ → info by review frame-introspection coverage/sysmon.py:341:29

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
                if frame is not None:
                    frame = inspect.currentframe().f_back  # type: ignore[union-attr]
                    if LOG:  # pragma: debugging
                        # @panopticon adds a frame.
```
likely benign LLM, confidence 0.95 Walks back one frame with currentframe().f_back for coverage bookkeeping.
Reasoning
Same frame-walking logic in the coverage tracer, with a debugging comment. No sign of evasion or malicious use.
info ~~warn~~ → info by review dynamic-execution coverage/templite.py:72:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        global_namespace: dict[str, Any] = {}
        exec(python_source, global_namespace)
        return global_namespace
```
likely benign LLM, confidence 0.85 Executes generated template source in a fresh namespace dict.
Reasoning
Templite is a small template engine that compiles generated Python source into a namespace. Exec of generated template code is its intended design, not hidden payload execution.
info ~~warn~~ → info by review unicode-zero-width doc/config.rst:415:61

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
(multi-string) A list of debug options.  See :ref:`the run -⟨U+200D⟩-debug option
<cmd_run_debug>` for details.
```
likely benign LLM, confidence 0.80 Zero-width joiner inserted into '--debug' in the docs to avoid dash rendering.
Reasoning
The ZWJ sits inside a double hyphen in reST to stop smart-dash conversion in the rendered docs. It is a documentation typesetting choice, not hidden instructions, though it is an unusual character.
info ~~warn~~ → info by review unicode-zero-width doc/config.rst:424:68

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
(string) A file name to write debug output to.  See :ref:`the run -⟨U+200D⟩-debug
option <cmd_run_debug>` for details.
```
likely benign LLM, confidence 0.80 Zero-width joiner in '--debug' option reference within the config docs.
Reasoning
Same ZWJ-in-double-hyphen pattern in the rst docs. Benign typesetting.
info ~~warn~~ → info by review unicode-zero-width doc/config.rst:693:24

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
The ``--debug=pathmap`` option can be used to log details of the re-mapping of
paths.  See :ref:`the -⟨U+200D⟩-debug option <cmd_run_debug>`.

See :ref:`cmd_combine_remapping` and :ref:`source_glob` for more information.
```
likely benign LLM, confidence 0.80 Zero-width joiner in '--debug' reference in the remapping docs.
Reasoning
Same ZWJ-in-double-hyphen pattern as the other doc findings. No payload or steering text.
info ~~warn~~ → info by review dynamic-execution igor.py:335:20

`subprocess.getoutput` called with a literal shell command (ast pass, confidence 0.70)
```
    facts.now = datetime.datetime.now()
    facts.branch = subprocess.getoutput("git rev-parse --abbrev-ref @")
    facts.sha = subprocess.getoutput("git rev-parse @")
    return facts
```
likely benign LLM, confidence 0.92 Runs a literal git rev-parse to get the branch name for build facts.
Reasoning
Fixed git command with no external input, used to collect branch metadata for build facts. Ordinary build-script behavior.
info ~~warn~~ → info by review dynamic-execution igor.py:336:17

`subprocess.getoutput` called with a literal shell command (ast pass, confidence 0.70)
```
    facts.branch = subprocess.getoutput("git rev-parse --abbrev-ref @")
    facts.sha = subprocess.getoutput("git rev-parse @")
    return facts
```
likely benign LLM, confidence 0.92 Runs a literal git rev-parse to get the commit SHA for build facts.
Reasoning
Fixed git rev-parse with a literal argument, collecting the commit SHA. No untrusted input.
info ~~warn~~ → info by review dynamic-attribute igor.py:507:19

reach-by-name through `globals.get` (ast pass, confidence 0.60)
```
        verb = args.pop(0)
        handler = globals().get("do_" + verb)
        if handler is None:
            print(f"*** No handler for {verb!r}")
```
likely benign LLM, confidence 0.90 Dispatches CLI verbs to do_* handler functions via globals lookup.
Reasoning
Command dispatcher in a dev script looks up do_<verb> handlers in globals. This is a normal CLI pattern with a fixed namespace.
info dynamic-execution lab/compare_times.sh:32:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)
```
$HYPERFINE 'python -m pytest test_file1.py'

echo "Coverage 4.5.4"
```

info dynamic-execution lab/compare_times.sh:36:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

pip install -q coverage==4.5.4
$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'

info dynamic-execution lab/compare_times.sh:37:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:38:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:39:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

echo "Coverage 5.0a8, no contexts"

info dynamic-execution lab/compare_times.sh:43:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

pip install -q coverage==5.0a8
$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'

info dynamic-execution lab/compare_times.sh:44:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:45:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:46:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

echo "Coverage 5.0a8, with test contexts"

info dynamic-execution lab/compare_times.sh:54:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)


$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'

info dynamic-execution lab/compare_times.sh:55:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:56:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:57:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

echo "Pytest-cov contexts"

info dynamic-execution lab/compare_times.sh:62:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)


$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-context=test test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch --cov-context=test test_file1.py'

info dynamic-execution lab/compare_times.sh:63:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-context=test test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch --cov-context=test test_file1.py'

info ~~warn~~ → info by review dynamic-execution lab/hack_pyc.py:19:21

`marshal.load` deserializes Python bytecode from bytes — code-object sink (ast pass, confidence 0.75)
```
        self.modtime = f.read(4)
        self.code = marshal.load(f)

    def write(self, f):
```
likely benign LLM, confidence 0.70 Loads a code object from a .pyc file with marshal for bytecode editing.
Reasoning
Lab utility that reads and rewrites .pyc files. marshal.load on a local file is the standard way to manipulate bytecode, and the file is in a lab directory. Deserialization risk is inherent, but nothing here indicates an attack.
info ~~warn~~ → info by review dynamic-execution lab/parser.py:173:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    code = compile(text, "", "exec", dont_inherit=True)
    for code_obj in all_code_objects(code):
        if text:
```
likely benign LLM, confidence 0.75 Compiles source text to iterate over nested code objects.
Reasoning
Compiles source text to walk code objects in a lab parser, likely for coverage analysis. Compiling source text is expected for this tool. No external attacker input is evident.
info ~~critical~~ → info by review dynamic-execution lab/run_sysmon.py:12:8

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
code = compile(open(the_program, encoding="utf-8").read(), filename=the_program, mode="exec")

my_id = sys.monitoring.COVERAGE_ID
```
likely benign LLM, confidence 0.75 Compiles a user-specified program file to run under sys.monitoring.
Reasoning
Lab runner that reads a program path from its arguments and compiles it under sys.monitoring. The module-scope placement is just the script's flow. This is a developer harness, not a dropper.
info ~~critical~~ → info by review dynamic-execution lab/run_sysmon.py:119:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
exec(code)
```
likely benign LLM, confidence 0.75 Executes the compiled target program in the sysmon lab runner.
Reasoning
Executes the code object compiled from the chosen program file in the same test harness. Expected for a runner script.
info ~~critical~~ → info by review dynamic-execution lab/run_trace.py:42:12

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
code = open(the_program, encoding="utf-8").read()
code_obj = compile(code, the_program, mode="exec")
sys.settrace(trace)
exec(code_obj)
```
likely benign LLM, confidence 0.75 Compiles a user-chosen program file to execute under a trace function.
Reasoning
Same runner pattern as run_sysmon: reads a program file path and compiles it for tracing. Developer test harness behavior.
info ~~critical~~ → info by review frame-introspection lab/run_trace.py:43:1

`sys.settrace` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
code_obj = compile(code, the_program, mode="exec")
sys.settrace(trace)
exec(code_obj)
```
likely benign LLM, confidence 0.75 Installs a trace function before running the target program.
Reasoning
sys.settrace in a lab runner to trace the target program. The anti-analysis flag is a heuristic false positive here, since tracing is the purpose of the script.
info ~~critical~~ → info by review dynamic-execution lab/run_trace.py:44:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
sys.settrace(trace)
exec(code_obj)
```
likely benign LLM, confidence 0.75 Executes the compiled target program under the installed tracer.
Reasoning
Executes the traced target program code object in the lab harness. Expected for this tool.
info ~~warn~~ → info by review dynamic-execution lab/show_pyc.py:42:12

`marshal.load` deserializes Python bytecode from bytes — code-object sink (ast pass, confidence 0.75)
```
        print("pysize %s (%d)" % (binascii.hexlify(size), struct.unpack("<L", size)[0]))
    code = marshal.load(f)
    show_code(code)
```
likely benign LLM, confidence 0.80 Loads a code object from a .pyc file so a lab script can display its contents.
Reasoning
marshal.load on a .pyc file is how a bytecode inspection tool reads the code object it then displays with show_code. The file is a lab viewer, not a dropper, and nothing in the snippet fetches or runs the payload.
info ~~warn~~ → info by review decoder-import-with-exec lab/show_pyc.py:52:12

file imports decoder module(s) binascii, marshal and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
def show_py_text(text, fname="<string>"):
    code = compile(text, fname, "exec", dont_inherit=True)
    show_code(code)
```
likely benign LLM, confidence 0.85 Compiles Python source text to a code object for display in a bytecode-viewer lab script.
Reasoning
The decoder-import shape is a bytecode viewer compiling source text to a code object and passing it to show_code, which disassembles it. The compiled code is displayed, not executed, so the multi-stage payload shape does not hold up.
info ~~warn~~ → info by review dynamic-execution lab/show_pyc.py:52:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
def show_py_text(text, fname="<string>"):
    code = compile(text, fname, "exec", dont_inherit=True)
    show_code(code)
```
likely benign LLM, confidence 0.85 Compiles a text argument into a code object for display rather than execution.
Reasoning
compile is called on a text parameter inside show_py_text, a helper whose output goes to show_code. This is the same viewer logic as the sibling finding, and the code is never exec'd.
info ~~warn~~ → info by review dynamic-execution setup.py:31:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        # Execute the code in version.py.
        exec(compile(version_file.read(), cov_ver_py, "exec", dont_inherit=True), module_globals)
    return module_globals
```
likely benign LLM, confidence 0.90 Executes the project's own version.py to read the package version during setup.
Reasoning
This is the standard coverage.py idiom for loading the version string by executing version.py from the repository into a module-globals dict. The source is a fixed file shipped with the project.
info ~~warn~~ → info by review dynamic-execution setup.py:31:14

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        # Execute the code in version.py.
        exec(compile(version_file.read(), cov_ver_py, "exec", dont_inherit=True), module_globals)
    return module_globals
```
likely benign LLM, confidence 0.90 Compiles the project's version.py source as part of reading the version during setup.
Reasoning
The compile call is the inner half of the same version.py loading idiom, reading a fixed project file. No network input or obfuscated data is involved.
info ~~critical~~ → info by review dynamic-execution tests/helpers.py:65:12

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
    proc = subprocess.Popen(
        cmd,
        shell=True,
```
likely benign LLM, confidence 0.80 Test helper that launches a shell command via subprocess.Popen with shell=True.
Reasoning
This is a test helper that runs a command string through the shell, which is common for invoking tools inside test fixtures. The command comes from test code, not from untrusted input, though shell=True with a variable command is worth a note.
info ~~warn~~ → info by review dynamic-execution tests/test_arcs.py:2575:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
            """)
        code_obj = compile(code, filename="hello.html", mode="exec")
        cov = coverage.Coverage(branch=True, debug=["trace"])
        with cov.collect():
```
likely benign LLM, confidence 0.90 Compiles a literal test program so coverage tracing can be checked against it.
Reasoning
The code is a fixed test snippet compiled to test coverage tracing of exec'd code. This is expected in the coverage test suite.
info ~~warn~~ → info by review dynamic-execution tests/test_arcs.py:2578:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        with cov.collect():
            exec(code_obj)
```
likely benign LLM, confidence 0.90 Executes the compiled test program under coverage collection.
Reasoning
exec runs the test code object inside a coverage collection context, which is the purpose of this test. The code comes from the test file itself.
info ~~warn~~ → info by review dynamic-execution tests/test_cmdline.py:195:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        globs = {n: getattr(expected, n) for n in self.MOCK_GLOBALS}
        code_obj = compile(code, "<code>", "exec", dont_inherit=True)
        eval(code_obj, globs, {})  # pylint: disable=eval-used
```
likely benign LLM, confidence 0.90 Compiles test source code for evaluation against mocked globals.
Reasoning
Compiles a test script's source with a fixed filename and evaluates it against mock globals to test command-line behavior. This is ordinary test scaffolding.
info ~~warn~~ → info by review dynamic-execution tests/test_cmdline.py:196:9

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        code_obj = compile(code, "<code>", "exec", dont_inherit=True)
        eval(code_obj, globs, {})  # pylint: disable=eval-used

        # Many of our functions take a lot of arguments, and cmdline.py
```
likely benign LLM, confidence 0.90 Evaluates the compiled test code with mock globals in a command-line test.
Reasoning
The eval is the execution step of the same test harness, with a pylint disable comment acknowledging the intent. The code is fixed test content.

info unicode-mixed-script tests/test_config.py:95:33

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

            [tool.coverage.html]
            title = "tabblo & «ταБЬℓσ»"
            [tool.coverage.plugins.a_plugin]
            hello = "world"

info unicode-mixed-script tests/test_config.py:107:53

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        assert cov.config.precision == 3
        assert cov.config.html_title == "tabblo & «ταБЬℓσ»"
        assert cov.config.fail_under == 90.5
        assert cov.config.get_plugin_options("plugins.a_plugin") == {"hello": "world"}

info unicode-mixed-script tests/test_config.py:948:32

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)
```
            [html]
            title = tabblo & «ταБЬℓσ» # numbers
            """,
        )
```

info unicode-mixed-script tests/test_config.py:955:53

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        assert cov.config.exclude_list == ["first", "✘weirdo", "third"]
        assert cov.config.html_title == "tabblo & «ταБЬℓσ» # numbers"

    @pytest.mark.parametrize("bad_file", ["nosuchfile.txt", "."])

info ~~warn~~ → info by review frame-introspection tests/test_context.py:241:13

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """Helper to return qualname_from_frame for the caller."""
    stack = inspect.stack()[1:]
    if any(sinfo.frame.f_code.co_name == "get_qualname" for sinfo in stack):
        # We're calling ourselves recursively, maybe because we're testing
```
likely benign LLM, confidence 0.90 Reads the call stack in a test helper to detect recursive get_qualname calls.
Reasoning
inspect.stack is used in a test helper to find whether get_qualname is already on the call stack for recursion checks. This is standard introspection for testing qualname logic.

info unicode-mixed-script tests/test_html.py:451:58

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        self.create_initial_files()
        self.make_file(".coveragerc", "[html]\ntitle = «ταБЬℓσ» numbers")
        self.run_coverage()
        index = self.get_html_index_content()

info unicode-mixed-script tests/test_html.py:460:50

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        self.make_file(".coveragerc", "[html]\ntitle = Good title\n")
        self.run_coverage(htmlargs=dict(title="«ταБЬℓσ» & stüff!"))
        index = self.get_html_index_content()
        expected = (

info unicode-mixed-script tests/test_html.py:1403:28

identifier `ʎd` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)


            upside_down = "ʎd˙ǝbɐɹǝʌoɔ"
            surrogate = "db40,dd00: x@"
            """.replace("@", surrogate),

info unicode-mixed-script tests/test_html.py:1403:33

identifier `ǝbɐɹǝʌoɔ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)


            upside_down = "ʎd˙ǝbɐɹǝʌoɔ"
            surrogate = "db40,dd00: x@"
            """.replace("@", surrogate),

info unicode-mixed-script tests/test_mixins.py:54:49

identifier `ταБℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

    def test_make_file_non_ascii(self) -> None:
        self.make_file("unicode.txt", "tablo: «ταБℓσ»")
        with open("unicode.txt", "rb") as f:
            text = f.read()

info ~~critical~~ → info by review dynamic-import tests/test_python.py:40:15

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
        # Run the code to see that we really got it encoded properly.
        mod = __import__("encoded_" + encoding)
        assert mod.encoding == encoding
```
likely benign LLM, confidence 0.90 Imports a test module whose name is built from the encoding under test.
Reasoning
__import__ loads a test module named with a fixed encoding prefix so the test can confirm that the source encoding declaration decodes correctly. The concatenated name comes from a parametrized test list, not from an external source.

info unicode-mixed-script tests/test_templite.py:325:24

identifier `ollǝɥ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

        self.try_render(
            "{{where}} ollǝɥ",
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",

info unicode-mixed-script tests/test_templite.py:326:24

identifier `ǝɹǝɥʇ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

            "{{where}} ollǝɥ",
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",
        )

info unicode-mixed-script tests/test_templite.py:327:14

identifier `ǝɹǝɥʇ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",
        )
```
info unicode-mixed-script tests/test_templite.py:327:25

identifier `ollǝɥ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",
        )
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/coveragepy/coveragepy coveragepy && cd coveragepy
git checkout 7.17.0
disclude scan --severity info --diff 7.16.2 .