PyPI / decorator / 5.3.1

decorator 5.3.1

Source

https://github.com/micheles/decorator

Tag scanned

5.3.1

Compared with

5.3.0 (0 signals introduced since)

Files

13 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 06:39

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review frame-introspection src/decorator/__init__.py:141:21

   `sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)

           try:
               frame = sys._getframe(3)
           except AttributeError:  # for IronPython and similar implementations
               callermodule = '?'

   likely benign LLM, confidence 0.93 Retrieves the caller's frame to determine the calling module name, with a fallback for IronPython.

   Reasoning

   This is the well-known decorator library, which uses sys._getframe(3) to find the caller's module name for namespace purposes. The try/except for IronPython shows a compatibility fallback. The sys.exit/exec/eval co-occurrence is a weak heuristic here and not an anti-analysis pattern.

2. info warn → info by review dynamic-execution src/decorator/__init__.py:173:20

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

           try:
               code = compile(src, filename, 'single')
               exec(code, evaldict)
           except Exception:

   likely benign LLM, confidence 0.90 Compiles generated wrapper source code so decorated functions keep their exact signatures.

   Reasoning

   The decorator library generates a wrapper function's source text and compiles it so the signature matches the original function exactly. The source is built from the decorated function's own signature, not from untrusted input. This is a known, documented technique in a widely used library.

3. info warn → info by review dynamic-execution src/decorator/__init__.py:174:13

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

               code = compile(src, filename, 'single')
               exec(code, evaldict)
           except Exception:
               print('Error in generated code:', file=sys.stderr)

   likely benign LLM, confidence 0.90 Executes the generated wrapper code in a controlled namespace to build a signature-preserving decorator.

   Reasoning

   This exec runs the code object produced by the signature-preserving compile step in the same function, in a controlled evaldict namespace. It is the second half of the legitimate code-generation pattern and has no encoded payload or external input.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/micheles/decorator decorator && cd decorator
git checkout 5.3.1
disclude scan --severity info --diff 5.3.0 .