PyPI / pkginfo / 2.0b1

pkginfo 2.0b1

Artifact scanned

pkginfo-2.0b1-py3-none-any.whl (wheel · 16.5 KB · SHA-256 13f46fc0d5f1…)

Compared with

pkginfo-1.13.3-py3-none-any.whl (0 signals introduced since)

Files

23 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

2.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-25 15:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import pkginfo/installed.py:15:17

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

               try:
                   __import__(package)
               except ImportError:
                   package = None

   likely benign LLM, confidence 0.85 A pkginfo helper dynamically imports a package by name to locate installed distribution metadata, with ImportError handled.

   Reasoning

   The __import__ call on a variable is wrapped in try/except ImportError and the result is used to locate an installed package's metadata. This is a standard dynamic-import pattern for optional or named package lookup in a metadata library; it is not decoding or executing hidden payloads. The severity is high for what is a routine pattern.

2. info critical → info by review dynamic-import pkginfo/utils.py:28:9

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       try:
           __import__(path_or_module)
       except ImportError:
           pass

   likely benign LLM, confidence 0.85 A pkginfo utility dynamically imports a user-supplied module name or path, swallowing ImportError.

   Reasoning

   The non-literal __import__ of path_or_module sits inside a try/except ImportError, consistent with a utility that accepts either a module name or path and imports it to read metadata. This is legitimate dynamic loading in a metadata library, with no encoding, network, or process spawning around it.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pkginfo-2.0b1-py3-none-any.whl https://files.pythonhosted.org/packages/80/3c/f2f53a1289ed3aa51ebbc42c638a5f457e14a259b81d1909b56b1c46f419/pkginfo-2.0b1-py3-none-any.whl
printf '%s  %s\n' 13f46fc0d5f17d55ddd35141af3fb582e0d50f852faead306d63fb8255db2bb9 pkginfo-2.0b1-py3-none-any.whl | shasum -a 256 -c -
unzip -q pkginfo-2.0b1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg