PyPI / hpack / 4.2.0

hpack 4.2.0

Source

https://github.com/python-hyper/hpack

Tag scanned

v4.2.0

Compared with

v4.1.0 (0 signals introduced since)

Files

27 scanned, 389 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 1 info

Scan time

3.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 06:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review payload-bytes-literal tests/test_hpack.py:538:13

   concatenated bytes literal contains 115 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)

           data = (
               b'\x82\x87D\x87a\x07\xa4\xacV4\xcfA\x8c\xf1\xe3\xc2\xe5\xf2:k\xa0'
               b'\xab\x90\xf4\xff@\x88%\xa8I\xe9[\xa9}\x7f\x89%\xa8I\xe9[\xb8\xe8'
               b'\xb4\xbfz\xbc\xd0\x7ff\xa2\x81\xb0\xda\xe0S\xfa\xd02\x1a\xa4\x9d'

   likely benign LLM, confidence 0.95 Test vector of HPACK-encoded HTTP/2 header bytes inside a unit test for the hpack library.

   Reasoning

   The file is a test module for hpack, an HTTP/2 header compression library. The flagged bytes begin with 0x82 0x87 0x44 0x87, which is the typical HPACK-encoded header block shape (indexed header fields and literal values). Concatenated \x escapes are the normal way to write such wire-format test vectors. The AST pass flags only the binary-looking literal shape, and nothing in the snippet suggests execution, decoding of a dropper, or any malicious action.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/python-hyper/hpack hpack && cd hpack
git checkout v4.2.0
disclude scan --severity info --diff v4.1.0 .