PyPI / pkginfo / 1.13.1

pkginfo 1.13.1

Artifact scanned

pkginfo-1.13.1-py3-none-any.whl (wheel · 32.5 KB · SHA-256 2184184d5147…)

Compared with

pkginfo-1.13-py3-none-any.whl (0 signals introduced since)

Files

34 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-25 15:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import pkginfo/installed.py:15:17

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

               try:
                   __import__(package)
               except ImportError:
                   package = None

   likely benign LLM, confidence 0.85 Dynamic __import__ of a module name inside a try/except ImportError probe in the pkginfo installed-package lookup.

   Reasoning

   The __import__ call on a variable is wrapped in try/except ImportError and the failure path just sets package to None, which is the standard pattern for probing whether an optional module is installed. The package name is a caller-supplied module name in a metadata library, not a decoded or remote payload. Severity is critical only because of the dynamic-import signal, which is overrated here.

2. info critical → info by review dynamic-import pkginfo/utils.py:28:9

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       try:
           __import__(path_or_module)
       except ImportError:
           pass

   likely benign LLM, confidence 0.85 Dynamic __import__ of a caller-supplied module or path in pkginfo's utility code, wrapped in an ImportError handler.

   Reasoning

   The __import__ of path_or_module is guarded by except ImportError with pass, consistent with a utility that loads a module by name or path for metadata extraction. No decoding, network access, or process spawning appears in the snippet. The dynamic import is expected for this kind of library and the critical severity overstates it.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pkginfo-1.13.1-py3-none-any.whl https://files.pythonhosted.org/packages/8e/7f/7f20f10ec37a4dce32313bb21c55548e211391876c11af6c674f26fb015c/pkginfo-1.13.1-py3-none-any.whl
printf '%s  %s\n' 2184184d5147601c4ef91d2dd544b2529402d4ea4138279da1e10a849f15597d pkginfo-1.13.1-py3-none-any.whl | shasum -a 256 -c -
unzip -q pkginfo-1.13.1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg