paramiko 5.1.0

Source: https://github.com/paramiko/paramiko
Artifact scanned: paramiko-5.1.0-py3-none-any.whl (wheel · 206.7 KB · SHA-256 d9fe6d67a9d0…)
Compared with: paramiko-5.0.1-py3-none-any.whl (0 signals introduced since)
Files: 43 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 2.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 10:06

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload paramiko/compress.py:37:18

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    def __init__(self):
        self.z = zlib.decompressobj()

    def __call__(self, data):
```
likely benign LLM, confidence 0.95 A compression helper in paramiko that wraps zlib.decompressobj to decompress SSH transport data.
Reasoning
This is paramiko's standard SSH transport compression wrapper. zlib.decompressobj() is used to decompress data streams received over the SSH connection for the zlib@openssh.com compression method. The flagged pattern is ordinary library behavior, not an embedded payload being unpacked and executed. No execution, process spawning, or network-triggered code path is shown.

info long-line paramiko/kex_group14.py:42:1

line length 530 characters (raw pass, confidence 0.50)

    P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F3

info long-line paramiko/kex_group16.py:32:1

line length 1042 characters (raw pass, confidence 0.50)

    P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F3

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o paramiko-5.1.0-py3-none-any.whl https://files.pythonhosted.org/packages/13/45/fa0e8d70cb25d2dae06bc238e580a84834f6ca53a4e2408cccc19a78db7b/paramiko-5.1.0-py3-none-any.whl
printf '%s  %s\n' d9fe6d67a9d0bbf3eb85b051d26ab850b678c02d060f32915b944e5ca6d0d9e1 paramiko-5.1.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q paramiko-5.1.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg