datadog 0.56.0

Source: https://github.com/DataDog/datadogpy
Artifact scanned: datadog-0.56.0-py2.py3-none-any.whl (wheel · 151.2 KB · SHA-256 7b77da845d8d…)
Compared with: datadog-0.55.0-py2.py3-none-any.whl (0 signals introduced since)
Files: 85 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 6.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-11-04 19:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload datadog/api/api_client.py:196:31

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
                try:
                    content = zlib.decompress(content, zlib.MAX_WBITS | 16)
                except zlib.error:
                    pass
```
likely benign LLM, confidence 0.90 Gzip decompression of the HTTP response body inside the Datadog API client.
Reasoning
The snippet calls zlib.decompress(content, zlib.MAX_WBITS | 16) and ignores zlib.error. The MAX_WBITS|16 flag selects gzip framing, which is what an HTTP client does when it inflates a gzip-encoded API response body. The payload is the server's response, not an embedded blob hidden in the package, so this is ordinary HTTP handling.
info ~~critical~~ → info by review dynamic-execution datadog/dogshell/wrap.py:122:16

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
    try:
        proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
    except Exception:
        print(u"Failed to execute %s" % (repr(cmd)), file=sys.stderr)
```
likely benign LLM, confidence 0.85 The `dog wrap` subcommand runs the user's own command through a shell.
Reasoning
The `dog wrap` command exists to run a user-specified command and capture its output, so shell=True with a runtime command is the feature itself. The command comes from the local user's invocation, not from attacker-controlled remote data, and failures are only printed to stderr. This is a legitimate, expected pattern for this tool.
info ~~critical~~ → info by review dynamic-execution datadog/dogstatsd/context_async.py:54:5

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
if sys.version_info >= (3, 5):
    exec(compile(ASYNC_SOURCE, __file__, "exec"))
```
likely benign LLM, confidence 0.88 Version-gated exec of a bundled source string that defines async helpers for Python 3.5+.
Reasoning
The module is guarded by a Python 3.5+ version check and execs a constant ASYNC_SOURCE string. This is a known compatibility technique: async def syntax would fail to parse on older interpreters, so the async-only code is kept as a string and compiled only where supported. Nothing in the snippet shows a network call, decoding of external data, or a process spawn.
info ~~critical~~ → info by review dynamic-execution datadog/dogstatsd/context_async.py:54:10

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
if sys.version_info >= (3, 5):
    exec(compile(ASYNC_SOURCE, __file__, "exec"))
```
likely benign LLM, confidence 0.88 compile() of the bundled ASYNC_SOURCE string, paired with the exec on the line above.
Reasoning
This is the compile() call that feeds the same exec in the same version-gated block. It compiles a constant module-level string with the module's own filename, so it is the same benign compatibility pattern and adds no new behavior.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o datadog-0.56.0-py2.py3-none-any.whl https://files.pythonhosted.org/packages/a9/f1/02a74ebb9ff633eacdeeab0c9b72ad7d538cdb39873536e7035123d69915/datadog-0.56.0-py2.py3-none-any.whl
printf '%s  %s\n' 7b77da845d8d4c01e3a2e74dc8a6b835593185a3875c37c763d2cfc3f2a176bf datadog-0.56.0-py2.py3-none-any.whl | shasum -a 256 -c -
unzip -q datadog-0.56.0-py2.py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg