PyPI / pkginfo / 1.13.3

pkginfo 1.13.3

Artifact scanned

pkginfo-1.13.3-py3-none-any.whl (wheel · 34.8 KB · SHA-256 66520cd19fdd…)

Compared with

pkginfo-1.13.2-py3-none-any.whl (0 signals introduced since)

Files

34 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

2.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-25 15:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import pkginfo/installed.py:15:17

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

               try:
                   __import__(package)
               except ImportError:
                   package = None

   likely benign LLM, confidence 0.85 Dynamic __import__ of a package name inside a try/except ImportError, used to test whether a package is installed.

   Reasoning

   The __import__ call is on a variable name, which is flagged as non-literal, but the surrounding code is a try/except ImportError that checks whether a package is importable and sets package to None on failure. That is a common, legitimate pattern for probing optional or installed modules. No decoding, network, or process spawning appears in the snippet. The critical severity overstates the risk for an AST dynamic-import signal in a packaging metadata library.

2. info critical → info by review dynamic-import pkginfo/utils.py:28:9

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       try:
           __import__(path_or_module)
       except ImportError:
           pass

   likely benign LLM, confidence 0.85 Dynamic __import__ of a module or path argument within a try/except ImportError that silently ignores failures.

   Reasoning

   The snippet calls __import__ on path_or_module, a parameter name suggesting the function accepts either a module name or a path, inside a try/except ImportError that passes on failure. This is a typical helper for loading modules dynamically by name in a metadata library. Nothing in the snippet decodes data, spawns processes, or reaches the network. The argument's origin is not shown, but the name and context point to legitimate use.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pkginfo-1.13.3-py3-none-any.whl https://files.pythonhosted.org/packages/f3/8f/3e29b55ad92de525931a5683ca245af58d50d5756f35cd74555aaf859427/pkginfo-1.13.3-py3-none-any.whl
printf '%s  %s\n' 66520cd19fddf3faa9554d68dcc0e6801944275bf612e8b581dfba968a9b4cc9 pkginfo-1.13.3-py3-none-any.whl | shasum -a 256 -c -
unzip -q pkginfo-1.13.3-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg