networkx 3.7

Source: https://github.com/networkx/networkx
Tag scanned: networkx-3.7
Compared with: networkx-3.6.1 (0 signals introduced since)
Files: 906 scanned, 49 skipped (binary, oversized, or unrecognised)
Signals: 1 critical · 0 warn · 12 info
Scan time: 10.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 9 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:37

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

critical dynamic-execution doc/release/report_functions_without_rst_generated.py:12:14

`os.popen` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
    # print(cmd)
    result = os.popen(cmd).read()
    # print(result)
```
likely benign LLM, confidence 0.60 A doc-maintenance script runs a shell command built at runtime and reads its output.
Reasoning
This is a developer documentation script that shells out with os.popen on a non-literal cmd. The command is probably a fixed grep-like invocation built from repo paths, but the snippet does not show where cmd comes from, so the shell call is not clearly safe.
info ~~warn~~ → info by review unicode-mixed-script doc/release/release_2.6.rst:659:22

identifier `frɨʂtat` mixes scripts: Latin + Other (raw pass, confidence 0.80)
```
- Martin Fleischmann
- Martha Frysztacki [frɨʂtat͡skʲ]
- Debargha Ganguly
- CUI Hao
```
likely benign LLM, confidence 0.95 IPA transcription of a contributor's name in a release notes author list.
Reasoning
The flagged token is part of an IPA phonetic transcription of a Polish-style surname in an author list, a legitimate use of IPA characters in a release note. Raw-pass unicode mixed-script findings are known to be noisy.
info ~~warn~~ → info by review unicode-mixed-script doc/release/release_2.6.rst:659:33

identifier `skʲ` mixes scripts: Latin + Other (raw pass, confidence 0.80)
```
- Martin Fleischmann
- Martha Frysztacki [frɨʂtat͡skʲ]
- Debargha Ganguly
- CUI Hao
```
likely benign LLM, confidence 0.95 Another IPA glyph fragment from the same contributor name transcription.
Reasoning
The fragment 'skʲ' is the same IPA transcription of the author's name, in the same line. It is a legitimate linguistic annotation.
info unicode-homoglyph examples/algorithms/plot_bipartite_motif_abcore.py:3:19

identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
--------------------------
Bipartite Motifs: α/β-core
--------------------------
```
info unicode-homoglyph examples/algorithms/plot_bipartite_motif_abcore.py:28:30

identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
    G_core.remove_nodes_from(remove_nodes)
print(f"Nodes comprising the α({alpha})/β({beta})-core of G: {set(G_core.nodes)}")

# Visualize the graph
```
info ~~warn~~ → info by review dynamic-execution networkx/algorithms/operators/tests/test_all.py:28:32

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        graph, node = n
        assert ghj.nodes[n] == eval(graph).nodes[int(node)]

    assert ghj.graph["attr"] == "attr"
```
likely benign LLM, confidence 0.85 Test code evaluates a graph-name string to get a graph object for comparison.
Reasoning
eval is used in a test to resolve a graph name from parametrized test data. This is a common test-harness pattern and not a payload.
info ~~warn~~ → info by review dynamic-execution networkx/algorithms/operators/tests/test_binary.py:23:31

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        graph, node = n
        assert gh.nodes[n] == eval(graph).nodes[int(node)]

    assert gh.graph["attr"] == "attr"
```
likely benign LLM, confidence 0.85 Test code evaluates a graph-name string to fetch a fixture graph.
Reasoning
Same test-harness pattern: eval resolves a graph fixture name from test parameters in a binary operator test.
info ~~warn~~ → info by review frame-introspection networkx/lazy_imports.py:170:22

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
        try:
            parent = inspect.stack()[1]
            frame_data = {
                "spec": fullname,
```
likely benign LLM, confidence 0.90 Lazy-import helper inspects the caller's stack frame to record the import site.
Reasoning
inspect.stack is used to find the calling frame's module so that lazy imports can report where they were requested. This is a standard technique in lazy-import helpers and not evasion.
info whitespace-anomaly networkx/readwrite/tests/test_gml.py:15:1

file mixes tab and space indentation (4 tab-indented and 664 space-indented lines) (raw pass, confidence 0.40)
```
class TestGraph:
    @classmethod
    def setup_class(cls):
        cls.simple_data = """Creator "me"
```
info ~~warn~~ → info by review dynamic-execution networkx/tests/test_lazy_imports.py:83:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    exec(s, {}, locls)
    expected = {
        "attach": lazy.attach,
```
likely benign LLM, confidence 0.80 A test executes a source snippet to verify lazy-import attach behaviour.
Reasoning
exec runs a test-supplied source string in a local namespace to check lazy attach behaviour. The source is a test fixture, not attacker-controlled input.
info ~~warn~~ → info by review decoder-import-with-exec networkx/utils/decorators.py:915:20

file imports decoder module(s) bz2, gzip and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
        filename = f"{self.__class__} compilation {self._count()}"
        compiled = compile(code, filename, "exec")
        exec(compiled, globl, locl)
        func = locl[sig.name]
```
likely benign LLM, confidence 0.85 Decorator code compiles and execs a generated wrapper whose signature matches the decorated function.
Reasoning
The file imports bz2 and gzip because open_file-style decorators must open compressed files. The compile/exec sequence builds a wrapper function with the decorated function's signature, a known metaprogramming pattern. Co-occurrence with decoder imports does not indicate a multi-stage payload here.
info ~~warn~~ → info by review dynamic-execution networkx/utils/decorators.py:915:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        filename = f"{self.__class__} compilation {self._count()}"
        compiled = compile(code, filename, "exec")
        exec(compiled, globl, locl)
        func = locl[sig.name]
```
likely benign LLM, confidence 0.85 compile turns the library-generated wrapper source into a code object.
Reasoning
compile here builds the generated wrapper source for the argmap decorator. The code string comes from the library's own template, so this is ordinary code generation.
info ~~warn~~ → info by review dynamic-execution networkx/utils/decorators.py:916:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        compiled = compile(code, filename, "exec")
        exec(compiled, globl, locl)
        func = locl[sig.name]
        func._code = code
```
likely benign LLM, confidence 0.85 exec runs the library-generated decorator wrapper code.
Reasoning
exec runs the compiled code object from the same library-generated wrapper, so the dynamic execution is internal metaprogramming rather than a dropper.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/networkx/networkx networkx && cd networkx
git checkout networkx-3.7
disclude scan --severity info --diff networkx-3.6.1 .