Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
src = f"lambda {signature}: _wrapper_({callargs})"
funcopy = eval(
src, dict(_wrapper_=wrapper)
)
likely benign
LLM, confidence 0.75
Builds a lambda source string from a function signature and evals it to create a signature-preserving wrapper.
Reasoning
This is the standard decorator-library pattern: a lambda is built from the wrapped function's signature and eval'd with a restricted globals dict. The comment says the source is checked by a signature-safety function first. The eval input is derived from code signatures, not network or user input, so the risk is low, though eval is still a sensitive sink.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
dec_func = eval(
src, dict(_func_=func, _call_=caller)
)
likely benign
LLM, confidence 0.75
Evals generated wrapper source to build a decorated function that preserves the original signature.
Reasoning
Same decorator-factory pattern as the sibling finding: src is generated from the decorated function's signature and eval'd with a fixed namespace of _func_ and _call_. The inline comment cites a validation step on the source. Nothing here reaches external input or does anything beyond defining a wrapper.
-
`compile` called on a non-literal expression (ast pass, confidence 0.70)
:data:`DEFAULT_TIMEOUT` at match time."""
return compile(src, flags)
likely benign
LLM, confidence 0.85
Compiles a regex source string into a pattern object, with flags.
Reasoning
compile() here turns a regex source string into a pattern object with flags. Compiling dynamic regex text is ordinary library behavior and is not code execution. The surrounding docstring describes a match-time timeout, consistent with ReDoS protection.
-
`compile` called on a non-literal expression (ast pass, confidence 0.70)
return _cached_compile(pattern, flags)
return compile(pattern, flags)
likely benign
LLM, confidence 0.90
Compiles a regex pattern with flags as a fallback to the cached compile.
Reasoning
This is a fallback that compiles a regex pattern with flags after a cache path. Regex compilation is the expected behavior and carries no execution risk.
-
`compile` called on a non-literal expression (ast pass, confidence 0.70)
flags = getattr(pattern, "flags", 0)
return compile(source_of(pattern), flags)
likely benign
LLM, confidence 0.85
Compiles a pattern's source text back into a regex object with its flags.
Reasoning
This compiles the textual form of a pattern object, obtained through source_of, with its flags. It is regex handling, not code execution, and fits the module's purpose of analyzing and guarding regex patterns.
-
4 rows of base64-like lines, lines 26-29 (first: base64-like blob (2228 bytes, compression ratio 0.72)) (raw pass, confidence 0.60)
"FIND": "R0lGODlhMAAiAPcAMf/////37//35//n1v97Off///f/9/f37/fexvfOvfeEQvd7QvdrQvdrKfdaKfdSMfdSIe/v9+/v7+/v5+/n3u/e1u/Wxu/Gre+1lO+tnO+thO+Ua+97Y+97Oe97Me9rOe9rMe9jOe9jMe9jIe9aMefe5+fe3ufezuece+eEWudzQudaIedSIedKMedKIedCKedCId7e1t7Wzt7Oxt7Gvd69vd69rd61pd6ljN6UjN6Ue96EY95zY95rUt5rQt5jMd5SId5KIdbn59be3tbGztbGvda1rdaEa9Z
likely benign
LLM, confidence 0.90
Embedded base64-encoded GIF image data in the NLTK NeMo demo app.
Reasoning
Base64 blob inside a GUI demo app storing GIF image data for button/label images; this is ordinary embedded image resource data in a Tkinter demo.
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
sys.path = [d for d in sys.path if d not in ("", ".")]
m = __import__(module)
sys.path = old_path
return m
likely benign
LLM, confidence 0.80
Dynamically imports a module by name after temporarily adjusting sys.path.
Reasoning
This is a helper that temporarily strips '' and '.' from sys.path, imports a named module, and restores sys.path. Dynamic import by module name is a normal plugin/stdlib-loading technique, and the module name comes from the library's own callers rather than untrusted data.
-
identifier `ǂKxʼauǁʼein` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
"adp": "Adap",
"aue": "ǂKxʼauǁʼein",
"bmy": "Bemba (Democratic Republic of Congo)",
"bxx": "Borna (Democratic Republic of Congo)",
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
safe_print("LazyModule: Loading module %r" % full_name)
self.__lazymodule_locals[local_name] = module = __import__(
full_name, self.__lazymodule_locals, self.__lazymodule_globals, "*"
)
likely benign
LLM, confidence 0.85
Lazily imports a wrapped module on first attribute access.
Reasoning
This is the standard lazy-module loader: on first attribute access it calls __import__ with the stored full module name and the module's own globals and locals. This is a well-known legitimate design, and the name is fixed by the library's module structure.
-
identifier `θin` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
>>> align('θin', 'tenwis') [[('θ', 't'), ('i', 'e'), ('n', 'n'), ('-', 'w'), ('-', 'i'), ('-', 's')]]
-
identifier `ən` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
todos,tu
una,ən
dos,dø
tres,trwa
-
identifier `arbrə` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
ombre,om
arbol,arbrə
pluma,plym
kabeθa,kap
-
identifier `kabeθa` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
pluma,plym
kabeθa,kap
boka,buʃ
pje,pje
-
identifier `buʃ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
kabeθa,kap
boka,buʃ
pje,pje
koraθon,kœr
-
identifier `koraθon` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
pje,pje
koraθon,kœr
ber,vwar
benir,vənir
-
identifier `vənir` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
ber,vwar
benir,vənir
deθir,dir
pobre,povrə
-
identifier `deθir` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
benir,vənir
deθir,dir
pobre,povrə
ðis,dIzes
-
identifier `povrə` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
deθir,dir
pobre,povrə
ðis,dIzes
ðæt,das
-
identifier `fleʃ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
mæn,man
fleʃ,flajʃ
bləd,blyt
feðər,fEdər
-
identifier `flajʃ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
mæn,man
fleʃ,flajʃ
bləd,blyt
feðər,fEdər
-
identifier `bləd` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
fleʃ,flajʃ
bləd,blyt
feðər,fEdər
hær,hAr
-
identifier `feðər` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
bləd,blyt
feðər,fEdər
hær,hAr
ir,Or
-
identifier `fEdər` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
bləd,blyt
feðər,fEdər
hær,hAr
ir,Or
-
identifier `awgə` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
ir,Or
aj,awgə
nowz,nAzə
mawθ,munt
-
identifier `nAzə` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
aj,awgə
nowz,nAzə
mawθ,munt
təŋ,tsuŋə
-
identifier `mawθ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
nowz,nAzə
mawθ,munt
təŋ,tsuŋə
fut,fys
-
identifier `təŋ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
mawθ,munt
təŋ,tsuŋə
fut,fys
nij,knI
-
identifier `tsuŋə` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
mawθ,munt
təŋ,tsuŋə
fut,fys
nij,knI
-
identifier `livər` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
hart,herts
livər,lEbər
ænd,ante
æt,ad
-
identifier `lEbər` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
hart,herts
livər,lEbər
ænd,ante
æt,ad
-
identifier `fiʃ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
ijt,edere
fiʃ,piʃkis
flow,fluere
staɾ,stella
-
identifier `piʃkis` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
ijt,edere
fiʃ,piʃkis
flow,fluere
staɾ,stella
-
identifier `staɾ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
flow,fluere
staɾ,stella
ful,plenus
græs,gramen
-
identifier `məðər` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
nij,genU
məðər,mAter
mawntən,mons
nejm,nomen
-
identifier `mawntən` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
məðər,mAter
mawntən,mons
nejm,nomen
njuw,nowus
-
identifier `wən` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
njuw,nowus
wən,unus
rawnd,rotundus
sow,suere
-
identifier `θrij` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
sit,sedere
θrij,tres
tuwθ,dentis
θin,tenwis
-
identifier `tuwθ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
θrij,tres
tuwθ,dentis
θin,tenwis
kinwawa,kenuaʔ
-
identifier `θin` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
tuwθ,dentis
θin,tenwis
kinwawa,kenuaʔ
nina,nenah
-
identifier `kenuaʔ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
θin,tenwis
kinwawa,kenuaʔ
nina,nenah
napewa,napɛw
-
identifier `napɛw` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
nina,nenah
napewa,napɛw
wapimini,wapemen
namesa,namɛʔs
-
identifier `namɛʔs` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
wapimini,wapemen
namesa,namɛʔs
okimawa,okemaw
ʃiʃipa,seʔsep
-
identifier `ʃiʃipa` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
okimawa,okemaw
ʃiʃipa,seʔsep
ahkohkwa,ahkɛh
pematesiweni,pematesewen
-
identifier `seʔsep` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
okimawa,okemaw
ʃiʃipa,seʔsep
ahkohkwa,ahkɛh
pematesiweni,pematesewen
-
identifier `ahkɛh` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
ʃiʃipa,seʔsep
ahkohkwa,ahkɛh
pematesiweni,pematesewen
asenja,aʔsɛn"""
-
identifier `aʔsɛn` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
pematesiweni,pematesewen
asenja,aʔsɛn"""
-
103 of 249 non-conventional identifiers are single-character (41%) (token pass, confidence 0.50)
-
reach-by-name through `globals` (ast pass, confidence 0.60)
raise ValueError(f"The language '{language}' is not supported.")
stemmerclass = globals()[language.capitalize() + "Stemmer"]
self.stemmer = stemmerclass(ignore_stopwords)
self.stem = self.stemmer.stem
likely benign
LLM, confidence 0.85
Looks up the language-specific stemmer class in module globals by constructed name.
Reasoning
The language argument is checked against supported languages earlier (ValueError is raised for unsupported ones), so the globals lookup is limited to the stemmer classes in this module. Resolving a class by name from a validated set is an ordinary dispatch pattern.
-
identifier `ˈæməzɒn` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
>>> amz = u'Amazon.com, Inc. (/ˈæməzɒn/) is an American electronic commerce...'
>>> rkt = u'Rakuten, Inc. (楽天株式会社 Rakuten Kabushiki-gaisha) is a Japanese electronic commerce and Internet company based in Tokyo.'
-
string literal compression ratio 0.954 (130 bytes) (raw pass, confidence 0.60)
>>> amz = u'Amazon.com, Inc. (/ˈæməzɒn/) is an American electronic commerce...'
>>> rkt = u'Rakuten, Inc. (楽天株式会社 Rakuten Kabushiki-gaisha) is a Japanese electronic commerce and Internet company based in Tokyo.'
likely benign
LLM, confidence 0.90
Doctest sample text containing ordinary multilingual prose flagged for compressibility.
Reasoning
This is a doctest string literal of natural-language text with accented and CJK characters. Its high compression ratio reflects ordinary English and Japanese prose in a short sample, not an encoded payload. The raw pass has a high false-positive rate for this kind of content.
-
identifier `Δj` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
:p0: 1 - p1
:dj: Displacement, Δj
References
-
identifier `Δv` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
:max_v: Maximum vacancy
:dv: Vacancy difference, Δv
The definition of v_head here differs from GIZA++, section 4.7 of
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io