PyPI / pkginfo / 1.13.2

pkginfo 1.13.2

Artifact scanned

pkginfo-1.13.2-py3-none-any.whl (wheel · 34.8 KB · SHA-256 f61e2ba606db…)

Compared with

pkginfo-1.13.1-py3-none-any.whl (0 signals introduced since)

Files

34 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-25 15:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import pkginfo/installed.py:15:17

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

               try:
                   __import__(package)
               except ImportError:
                   package = None

   likely benign LLM, confidence 0.85 Dynamic __import__ of a caller-supplied package name guarded by an ImportError handler in pkginfo's installed-package lookup.

   Reasoning

   The __import__ call on a variable is wrapped in try/except ImportError and falls back to setting package to None, which is the standard pattern for probing whether an optional module is importable. The package name is a function parameter in a metadata-reading library, so it is not decoded or attacker-controlled data from an encoded blob. Dynamic import is flagged at critical severity by the AST pass, but the context is consistent with a legitimate optional-dependency check.

2. info critical → info by review dynamic-import pkginfo/utils.py:28:9

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       try:
           __import__(path_or_module)
       except ImportError:
           pass

   likely benign LLM, confidence 0.85 Dynamic __import__ of a path-or-module argument with ImportError suppressed in pkginfo's utility loader.

   Reasoning

   The __import__ call uses a non-literal path_or_module argument inside a try/except ImportError that silently passes. This is a common module-loading helper in a metadata library that accepts either a path or a module name. There is no decoding, process spawning, or network activity in the snippet, and the import target comes from the caller's arguments rather than an embedded payload. Dynamic import alone is a weak signal here, so the verdict is likely benign.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pkginfo-1.13.2-py3-none-any.whl https://files.pythonhosted.org/packages/89/1e/9b51798addc534d5eaa13477039eb5abeb0143e14eb853b7176321dbfc27/pkginfo-1.13.2-py3-none-any.whl
printf '%s  %s\n' f61e2ba606dbfd79f5e5870157da5196bb1596f74e6b19efa40c6d88d904d40c pkginfo-1.13.2-py3-none-any.whl | shasum -a 256 -c -
unzip -q pkginfo-1.13.2-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg