PyPI / msal / 1.39.0

msal 1.39.0

Source

https://github.com/AzureAD/microsoft-authentication-library-for-python

Artifact scanned

msal-1.39.0-py3-none-any.whl (wheel · 128.5 KB · SHA-256 2d2577886906…)

Compared with

msal-1.38.0-py3-none-any.whl (0 signals introduced since)

Files

25 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

4.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 08:39

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review encoding-base64 msal/__main__.py:166:31

   base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

   _JWK1 = """{"kty":"RSA", "n":"2tNr73xwcj6lH7bqRZrFzgSLj7OeLfbn8216uOMDHuaZ6TEUBDN8Uz0ve8jAlKsP9CQFCSVoSNovdE-fs7c15MxEGHjDcNKLWonznximj8pDGZQjVdfK-7mG6P6z-lgVcLuYu5JcWU_PeEqIKg5llOaz-qeQ4LEDS4T1D2qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3F

   likely benign LLM, confidence 0.90 A JSON Web Key literal (public RSA parameters) stored as a string constant in the msal package's __main__.py.

   Reasoning

   This is a raw-pass base64-like match on a JWK string literal (kty RSA, modulus n, exponent e AQAB) assigned to _JWK1 in msal's own CLI module. The value is a public RSA key with the standard JWK structure, which is ordinary data for a token library's test or demo path. Raw-pass base64 matches on long URL-safe strings are a known false-positive pattern, and nothing here decodes, executes, or reaches the network.

2. info warn → info by review encoding-base64 msal/__main__.py:166:247

   base64-like blob (104 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

   qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3Fe11Xz8AEBl3anKFSJcTvlMnFtu3EpD-eiaHfTgRBU7CztGQqVbiQ", "e":"AQAB"}"""⟨U+000D⟩

   likely benign LLM, confidence 0.90 The tail of the same JWK string constant, containing the rest of the RSA modulus and the exponent.

   Reasoning

   This is the continuation of the same JWK string literal as the earlier finding on this line: the rest of the modulus n followed by e AQAB and the closing brace. It is a public key parameter blob with no executable or obfuscated behaviour, so the same benign reading applies.

3. info encoding-base64 msal/__main__.py:195:176

   base64-like blob (68 bytes, compression ratio 0.90) (in comment) (raw pass, confidence 0.36)

       POP_SCOPE = ['6256c85f-0aad-4d50-b960-e6e9b21efe35/.default']  # KAP 1P Server App Scope, obtained from https://github.com/Azure/azure-cli-extensions/pull/4468/files#diff-a47efa3186c7eb4f1176e07d0b858ead0bf4a58bfd51e448ee3607a5b4ef47f6R116⟨U+000D⟩
       result = _acquire_token_interactive(app, scopes=POP_SCOPE)

4. info whitespace-anomaly msal/broker.py:14:1

   file mixes tab and space indentation (1 tab-indented and 226 space-indented lines) (raw pass, confidence 0.40)

   try:⟨U+000D⟩
       import pymsalruntime  # Its API description is available in site-packages/pymsalruntime/PyMsalRuntime.pyi⟨U+000D⟩
       pymsalruntime.register_logging_callback(lambda message, level: {  # New in pymsalruntime 0.7⟨U+000D⟩
           pymsalruntime.LogLevel.TRACE: logger.debug,  # Python has no TRACE level

5. info encoding-base64 msal/throttled_http_client.py:16:98

   base64-like blob (67 bytes, compression ratio 0.87) (in comment) (raw pass, confidence 0.36)

       # MSAL's HttpResponse did not have headers until 1.23.0⟨U+000D⟩
       # https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/581/files#diff-28866b706bc3830cd20485685f20fe79d45b58dce7050e68032e9d9372d68654R61⟨U+000D⟩
       # This helper ensures graceful degradation to {} without exception

6. info whitespace-anomaly msal/token_cache.py:46:1

   file mixes tab and space indentation (1 tab-indented and 524 space-indented lines) (raw pass, confidence 0.40)

   _EXT_CACHE_KEY_EXCLUDED_FIELDS = frozenset({⟨U+000D⟩
       # Standard OAuth2 body parameters — these appear in every token request⟨U+000D⟩
       # and must NOT influence the extended cache key.⟨U+000D⟩
       # Only non-standard fields (e.g. fmi_path) should contribute to the hash.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o msal-1.39.0-py3-none-any.whl https://files.pythonhosted.org/packages/a4/32/178457385925ce301c7b3232bd85665d4df57da39568b62dcfc74031873f/msal-1.39.0-py3-none-any.whl
printf '%s  %s\n' 2d2577886906cd7293850dffa2da29119966c213bfc6ec0cecf8bf7621e1ca77 msal-1.39.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q msal-1.39.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg