PyPI / distlib / 0.4.4

distlib 0.4.4

Source

https://github.com/pypa/distlib

Artifact scanned

distlib-0.4.4-py2.py3-none-any.whl (wheel · 461.0 KB · SHA-256 cf09d55b1e85…)

Compared with

distlib-0.4.3-py2.py3-none-any.whl (0 signals introduced since)

Files

15 scanned, 9 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

4.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 06:04

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review decoder-decompress-payload distlib/locators.py:603:20

   file imports decoder module(s) gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

           limit = self.decode_size_limit
           produced = decompressor.decompress(data, limit + 1)
           if len(produced) > limit or decompressor.unconsumed_tail:
               raise DistlibException('Decompressed index response exceeds '

   likely benign LLM, confidence 0.90 Size-limited decompression of a package index response in distlib's locator.

   Reasoning

   The code decompresses an index HTTP response with a size limit to guard against decompression bombs; this is a legitimate use of zlib/gzip decompression of downloaded data, not an embedded hidden payload.

2. info critical → info by review dynamic-import distlib/resources.py:339:13

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

           if package not in sys.modules:
               __import__(package)
           module = sys.modules[package]
           path = getattr(module, '__path__', None)

   likely benign LLM, confidence 0.85 Dynamic import of a package by name to locate resource paths.

   Reasoning

   distlib's resource loader imports a package by its name to find its __path__, a standard dynamic import pattern in packaging libraries. The package name comes from internal module resolution, not attacker-controlled input shown in the snippet, so the critical severity is overstated.

3. info critical → info by review dynamic-import distlib/util.py:680:15

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       else:
           mod = __import__(module_name)
       if dotted_path is None:
           result = mod

   likely benign LLM, confidence 0.85 Dynamic import of a module from a dotted path name in distlib utilities.

   Reasoning

   This is the standard resolver for dotted paths used by distlib to import a named module and then walk attributes, a common legitimate pattern in utility code. Nothing in the snippet shows obfuscation or a malicious payload.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o distlib-0.4.4-py2.py3-none-any.whl https://files.pythonhosted.org/packages/c1/2b/238f02a4927fa2e27aa995371d240a468b52e42eae44a678434aff736b38/distlib-0.4.4-py2.py3-none-any.whl
printf '%s  %s\n' cf09d55b1e85a89576b036aeb71550bfd68320f3f21761ca329eadadad918638 distlib-0.4.4-py2.py3-none-any.whl | shasum -a 256 -c -
unzip -q distlib-0.4.4-py2.py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg