kiwisolver 1.5.1

Source: https://github.com/nucleic/kiwi
Artifact scanned: kiwisolver-1.5.1.tar.gz (sdist · 101.9 KB · SHA-256 f1303ef2eec8…)
Compared with: kiwisolver-1.5.0.tar.gz (0 signals introduced since)
Files: 82 scanned, 14 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 2.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 08:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution benchmarks/build_and_run_bench.sh:9:1

command name is a variable (`$CXX_COMPILER`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
"$CXX_COMPILER" ${CXX_FLAGS} -O2 -Wall -pedantic -I.. enaml_like_benchmark.cpp -o run_bench

./run_bench
```
likely benign LLM, confidence 0.85 A benchmark build script that invokes a user-configurable C++ compiler on a local source file and then runs the produced binary.
Reasoning
The script runs a compiler from a variable $CXX_COMPILER, which is a common and expected pattern in build scripts that let the user choose a compiler. It compiles a local benchmark source file and runs the resulting local binary. The flagged behavior is the variable command name, which the message notes is set by the caller or environment. Nothing in the snippet indicates an encoded payload, network access, or hidden behavior, so this looks like a legitimate benchmark build script.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o kiwisolver-1.5.1.tar.gz https://files.pythonhosted.org/packages/ba/07/bd78e6a8fae171ea041ef5bba3ed21a003522fa088834b069b1909981f30/kiwisolver-1.5.1.tar.gz
printf '%s  %s\n' f1303ef2eec81262a4b708c3e858afe58d7c75ad91c1c05266eda7673369859a kiwisolver-1.5.1.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf kiwisolver-1.5.1.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg