PyPI / identify / 2.6.20

identify 2.6.20

Source

https://github.com/pre-commit/identify

Tag scanned

v2.6.20

Compared with

v2.6.19 (0 signals introduced since)

Files

15 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

2.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 06:06

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review payload-bytes-literal tests/identify_test.py:125:9

   concatenated bytes literal contains 39 `\xNN` escapes (83% of content) — binary payload shape (ast pass, confidence 0.85)

       x.write_binary(
           b'bplist00\xd1\x01\x02_\x10\x0fLast Login NameWDefault\x08\x0b\x1d\x00'
           b'\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00'
           b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00%',

   likely benign LLM, confidence 0.93 Test fixture writing a binary Apple plist byte sequence to a file to verify type identification.

   Reasoning

   The file is a test for file-type identification in the pre-commit identify library. The bytes literal begins with 'bplist00', the magic header of an Apple binary plist, followed by a plist-like structure containing 'Last Login Name' and 'Default'. This is test fixture data written to disk with write_binary to exercise binary plist detection. It is a legitimate binary sample, not obfuscated code or a dropper, and the escape density is expected for a binary fixture.

2. info unicode-mixed-script tests/identify_test.py:230:11

   identifier `éóñəå` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

           (b'', True),
           ('éóñəå  ⊂(◉‿◉)つ(ノ≥∇≤)ノ'.encode(), True),
           (r'¯\_(ツ)_/¯'.encode(), True),
           ('♪┏(・o･)┛♪┗ ( ･o･) ┓♪┏ ( ) ┛♪┗ (･o･ ) ┓♪'.encode(), True),

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/pre-commit/identify identify && cd identify
git checkout v2.6.20
disclude scan --severity info --diff v2.6.19 .