disclude.ioorjson 3.13.0
- Source
- https://github.com/ijl/orjson
- Artifact scanned
orjson-3.13.0.tar.gz- Compared with
orjson-3.12.0.tar.gz(0 signals introduced since)- Files
- 1096 scanned, 185 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 19 info
- Scan time
- 10.9 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 07:04
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
-
// Test case copied from LLVM let s = "İıÀàĀāĹĺЕеẦầKkⰝⱍＭｍ𐲒𐳒"; assert_eq!; } -
// Test case copied from LLVM let s = "İıÀàĀāĹĺЕеẦầKkⰝⱍＭｍ𐲒𐳒"; assert_eq!; } -
=likely benign Pasted GNU linker diagnostic containing Rust mangled symbol names, flagged as an embedded bash command.Reasoning
The snippet is linker error output pasted into a Markdown README. The '$LT' and '$no_pani' fragments are Rust mangled symbol names, not shell commands, and nothing in the snippet is executed.
-
likely benign Continuation of the same linker output with mangled Rust symbol fragments misread as shell commands.
Reasoning
Same README: the flagged '$u20' and '$as' tokens are fragments of a Rust mangled symbol inside linker output. The scanner misread them as shell commands; this is documentation text.
-
-
-
likely benign Doc example piping a demonstration string into bash to show a shell quoting pitfall.
Reasoning
This is a documentation example in a shlex quoting warning showing how unquoted bytes change how bash parses input. The pipe into bash is a deliberate illustration of the hazard, not an attack payload.
-
likely benign Second doc example in the shlex quoting warning showing bash output for a piped string.
Reasoning
Same doc page and same pedagogical pattern: a shell session output showing the effect of piping crafted input into bash. It is illustrative text inside a markdown file.
-
-
assert!; -
assert!; -
assert!; -
assert!; -
likely benign Conditional macro mapping the C keyword _Bool to bool for older compilers and C++ interop in yyjson.
Reasoning
The redefinition sits inside a compiler-specific conditional (GNUC without strict ANSI) and maps _Bool to bool for C++ compatibility, which is a known portability idiom in bundled JSON libraries. It is unusual and rebinds a keyword, but the context looks like legitimate compatibility code rather than an attack.
-
1~!@#$%^&*()_+-={\':[,]}|;.</>?","hex":"ģ䕧覫췯ꯍ\uef4a","true":true,"false":false,"null":null,"array":[],"object":{},"address":"50 St. James Street","url":"http://www.JSON.org/","comment":"// /* <!-- --","# -- --> */":" "," s p a c e d ":[1,2,3,4,5,6,7],"compact":[1,2,3,4,5,6,7],"jsontext":"{\\"object with 1 memb -
" \\" %22 0x22 034 "","/\\\\\\"쫾몾ꮘﳞ볚\uef4a\\b\\f\\n\\r\\t`1~!@#$%^&*()_+-=[]{}|;:\',./<>?":"A key can be any string"},0.5,98.6,99.44,1066,10.0,1.0,0.1,1.0,2.0,2.0,"rosebud"]'.encode() -
= =likely benign Test helper that reads a local file and decompresses it with lzma when the suffix is .xz.Reasoning
The code decompresses a local .xz file read from disk in a test utility. The payload is a repository file, not a hidden or embedded blob fetched at runtime, and lzma decompression is a normal test-fixture operation.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&