distlib 0.4.4

Source: https://github.com/pypa/distlib
Tag scanned: 0.4.4
Compared with: 0.4.3 (0 signals introduced since)
Files: 85 scanned, 90 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 16 info
Scan time: 5.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 19:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload distlib/locators.py:603:20

file imports decoder module(s) gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        limit = self.decode_size_limit
        produced = decompressor.decompress(data, limit + 1)
        if len(produced) > limit or decompressor.unconsumed_tail:
            raise DistlibException('Decompressed index response exceeds '
```
likely benign LLM, confidence 0.80 Size-limited decompression of an index HTTP response in distlib's locator.
Reasoning
This is distlib's index-fetching code applying a size-limited zlib/gzip decompress to an HTTP response body with a limit check; it is a defensive decompression bomb guard, not a hidden payload. The pattern is legitimate.
info ~~critical~~ → info by review dynamic-import distlib/resources.py:339:13

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        if package not in sys.modules:
            __import__(package)
        module = sys.modules[package]
        path = getattr(module, '__path__', None)
```
likely benign LLM, confidence 0.85 Importing a package by name to locate its resource path in distlib's resource finder.
Reasoning
Dynamic __import__ of a package name is the standard way to load a package before reading its __path__ in a resource finder; the package name comes from the caller's module name, not attacker-controlled network input. Severity is overstated for this legitimate library pattern.
info ~~critical~~ → info by review dynamic-import distlib/util.py:680:15

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    else:
        mod = __import__(module_name)
    if dotted_path is None:
        result = mod
```
likely benign LLM, confidence 0.85 Dotted-name resolver in distlib's util module importing a module by name.
Reasoning
This is the standard resolve_name helper that imports a dotted module path to resolve a string reference, a common and expected utility in packaging libraries. No encoded payload or suspicious source is involved.
info ~~warn~~ → info by review whitespace-anomaly docs/tutorial.rst:1007:5

invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)
```
   └── nested
    ⟨U+00A0⟩⟨U+00A0⟩ └── nested_resource.bin

Access to resources in the file system
```
likely benign LLM, confidence 0.90 Non-breaking space characters in the indentation of a documentation tree diagram.
Reasoning
A non-breaking space in an RST directory-tree diagram's indentation is a common copy-paste artifact in documentation. It is harmless and has no code effect.
info dynamic-execution tests/minimext/build_wheels.sh:59:5

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    set -x
    ${dryrun} sudo add-apt-repository ppa:deadsnakes/ppa
    set +x
  fi
```
info dynamic-execution tests/minimext/build_wheels.sh:70:5

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)
```
    set -x
    ${dryrun} sudo apt install "${PYTHON_APT_PACKAGES[@]}"
    set +x
  fi
```

info dynamic-execution tests/minimext/build_wheels.sh:85:10

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Try to bootstrap pip if it isn't found.
    if ! ${dryrun} "${versioned_python}" -c "import pip" 2> /dev/null; then
      # shellcheck disable=SC2155
      local temporary_directory="$(mktemp -d)"

info dynamic-execution tests/minimext/build_wheels.sh:89:7

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)

      local get_pip="${temporary_directory}/get-pip-${version}.py"
      ${dryrun} curl --output "${get_pip}" \
           "https://bootstrap.pypa.io/pip/${version}/get-pip.py"
      ${dryrun} "${versioned_python}" "${get_pip}"

info dynamic-execution tests/minimext/build_wheels.sh:91:7

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)

           "https://bootstrap.pypa.io/pip/${version}/get-pip.py"
      ${dryrun} "${versioned_python}" "${get_pip}"
      rm -rf "${temporary_directory}"
    fi

info dynamic-execution tests/minimext/build_wheels.sh:96:5

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Install virtualenv as venv isn't available in all Python versions.
    ${dryrun} "${versioned_python}" -m pip install virtualenv
    ${dryrun} "${versioned_python}" -m virtualenv "${venv_directory}"
    (

info dynamic-execution tests/minimext/build_wheels.sh:97:5

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)

    ${dryrun} "${versioned_python}" -m pip install virtualenv
    ${dryrun} "${versioned_python}" -m virtualenv "${venv_directory}"
    (
      cd "${THIS_DIRECTORY}"

info dynamic-execution tests/minimext/build_wheels.sh:100:7

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)

      cd "${THIS_DIRECTORY}"
      ${dryrun} source "${venv_directory}/bin/activate"
      # Upgrade pip and setuptools.
      ${dryrun} pip install -U pip

info dynamic-execution tests/minimext/build_wheels.sh:102:7

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)

      # Upgrade pip and setuptools.
      ${dryrun} pip install -U pip
      ${dryrun} pip install -U setuptools
      # Build wheels to the wheels subdirectory.

info dynamic-execution tests/minimext/build_wheels.sh:103:7

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)

      ${dryrun} pip install -U pip
      ${dryrun} pip install -U setuptools
      # Build wheels to the wheels subdirectory.
      for embed_extension_metadata in 0 1; do

info dynamic-execution tests/minimext/build_wheels.sh:107:9

command name is a variable (`$dryrun`) that this file sets only to plain text (ast pass, confidence 0.40)

        set -x
        MINIMEXT_EMBED_EXTENSIONS_METADATA=${embed_extension_metadata} \
          ${dryrun} pip wheel . -w "${wheels_directory}"
        set +x

info ~~critical~~ → info by review dynamic-execution tests/test_scripts.py:118:17

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
            filenames = maker.make('script8.py')
            p = subprocess.Popen(filenames[0], shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
            stdout, stderr = p.communicate()
            self.assertEqual(p.returncode, 0)
```
likely benign LLM, confidence 0.85 Test code executing a generated test script through a shell via subprocess.Popen.
Reasoning
This is a unit test running a script generated by the test's own maker fixture via shell=True. The command is test-controlled and the file is a test, so it is not a malicious runtime shell invocation, though shell=True with a generated path is a minor hygiene concern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pypa/distlib distlib && cd distlib
git checkout 0.4.4
disclude scan --severity info --diff 0.4.3 .