PyPI / pkginfo / 2.0b2

pkginfo 2.0b2

Artifact scanned

pkginfo-2.0b2-py3-none-any.whl (wheel · 16.5 KB · SHA-256 27647dedf235…)

Compared with

pkginfo-2.0b1-py3-none-any.whl (0 signals introduced since)

Files

23 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-25 15:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import pkginfo/installed.py:15:17

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

               try:
                   __import__(package)
               except ImportError:
                   package = None

   likely benign LLM, confidence 0.85 Dynamic __import__ of a package name inside a try/except ImportError, used to look up installed package metadata.

   Reasoning

   The snippet calls __import__ on a variable named package inside a try/except ImportError that falls back to None. This matches pkginfo's purpose of locating an installed distribution's metadata by name. Dynamic import is a normal technique for this, and nothing here decodes data, spawns processes or reaches the network. The source of the package name is not shown, but the surrounding code points to a benign lookup.

2. info critical → info by review dynamic-import pkginfo/utils.py:28:9

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       try:
           __import__(path_or_module)
       except ImportError:
           pass

   likely benign LLM, confidence 0.85 Dynamic __import__ of a caller-supplied module path or name, with ImportError suppressed.

   Reasoning

   The snippet imports a module from a path_or_module argument inside a try/except ImportError that passes silently. This is a generic helper for loading a module by name or path, which is a common legitimate pattern in a metadata-parsing library. The snippet shows no decoding, process spawning or network activity. The argument's origin is not shown, which leaves some doubt.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pkginfo-2.0b2-py3-none-any.whl https://files.pythonhosted.org/packages/74/45/f3221a73236ad46dadd0f62fdc2c17ecb04a2e3c26938dab3eb2fb201c00/pkginfo-2.0b2-py3-none-any.whl
printf '%s  %s\n' 27647dedf2353924e72918bd2856da7485a09d8fb775e33307fef1577f63f434 pkginfo-2.0b2-py3-none-any.whl | shasum -a 256 -c -
unzip -q pkginfo-2.0b2-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg