identify 2.6.20

Source: https://github.com/pre-commit/identify
Tag scanned: v2.6.20
Compared with: v2.6.19 (0 signals introduced since)
Files: 15 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 2.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:52

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review payload-bytes-literal tests/identify_test.py:125:9

concatenated bytes literal contains 39 `\xNN` escapes (83% of content) — binary payload shape (ast pass, confidence 0.85)
```
    x.write_binary(
        b'bplist00\xd1\x01\x02_\x10\x0fLast Login NameWDefault\x08\x0b\x1d\x00'
        b'\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00'
        b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00%',
```
likely benign LLM, confidence 0.93 Test fixture writing a binary plist (bplist00) byte sequence to check file identification.
Reasoning
The file is a test for file-type identification. The bytes literal starts with 'bplist00', the magic header of an Apple binary property list, followed by a plist trailer structure. The test writes this as a fixture so the identifier can recognise bplist files. This is a legitimate binary test fixture, not obfuscation or a dropper. The escape density is expected for binary test data.

info unicode-mixed-script tests/identify_test.py:230:11

identifier `éóñəå` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

        (b'', True),
        ('éóñəå  ⊂(◉‿◉)つ(ノ≥∇≤)ノ'.encode(), True),
        (r'¯\_(ツ)_/¯'.encode(), True),
        ('♪┏(・o･)┛♪┗ ( ･o･) ┓♪┏ ( ) ┛♪┗ (･o･ ) ┓♪'.encode(), True),

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pre-commit/identify identify && cd identify
git checkout v2.6.20
disclude scan --severity info --diff v2.6.19 .