platformdirs 4.13.3

Source: https://github.com/tox-dev/platformdirs
Tag scanned: 4.13.3
Compared with: 4.13.2 (0 signals introduced since)
Files: 33 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 5.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 17:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review path-command-shadow docs/howto.rst:266:5

[embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    > set WIN_PD_OVERRIDE_LOCAL_APPDATA=X:\appdata
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
likely benign LLM, confidence 0.85 RST doc showing a python -c invocation of platformdirs to print a user cache directory on Windows.
Reasoning
This is a documentation example showing a Windows shell session that sets an environment variable and runs python -c to print a cache path. The 'python' name matching a system command is just the normal invocation of the interpreter in a how-to, not a PATH hijack setup. No download or dropper behavior is present.
info ~~warn~~ → info by review obfuscated-command-name docs/howto.rst:267:5

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
dismissed LLM, confidence 0.85 Example output path in a Windows-style docs snippet, misdetected as an obfuscated command.
Reasoning
The flagged 'backslash escapes' are simply the Windows path separators in an example output line (X:\appdata\Acme\MyApp\Cache). The heuristic misread a Windows path as an obfuscated command name. No command is hidden.
info ~~warn~~ → info by review dynamic-attribute src/platformdirs/testing.py:61:20

reach-by-name through `vars` (ast pass, confidence 0.60)
```
    cls = platformdirs.PlatformDirs
    saved = {name: vars(cls)[name] for name in patches if name in vars(cls)}
    for name, value in patches.items():
        setattr(cls, name, value)
```
likely benign LLM, confidence 0.80 Test utility that saves and overrides PlatformDirs class attributes with setattr for mocking.
Reasoning
This is a test helper that temporarily patches PlatformDirs attributes via setattr, saving originals in a dict and presumably restoring them afterward. Reading and writing class attributes by name via vars() is a normal monkeypatching technique in test utilities for a library like platformdirs.
info ~~critical~~ → info by review builtins-write tests/test_api.py:171:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
        try:
            builtins.__import__ = _fake_import  # ty: ignore[invalid-assignment]
            for name, _ in platformdirs_module_items:
                del sys.modules[name]
```
likely benign LLM, confidence 0.80 Test code temporarily swapping builtins.__import__ to simulate import conditions for platformdirs modules.
Reasoning
This is a test that replaces builtins.__import__ with a fake import to simulate a platform or missing-module condition, deleting platformdirs modules from sys.modules to force re-import. It is scoped to a test and the snippet shows a restore path nearby. Patching __import__ is unusual but legitimate for testing import-time behavior; it is not malicious.
info ~~critical~~ → info by review builtins-write tests/test_api.py:177:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
            # restore original modules
            builtins.__import__ = builtin_import
            for name, module in platformdirs_module_items:
                sys.modules[name] = module
```
likely benign LLM, confidence 0.80 Test cleanup restoring builtins.__import__ and sys.modules after an import-simulation test.
Reasoning
This is the restore half of the same test: it reinstates the original builtins.__import__ and re-populates sys.modules with the saved module objects. This confirms the earlier patch is temporary and reverted, consistent with benign test isolation.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/tox-dev/platformdirs platformdirs && cd platformdirs
git checkout 4.13.3
disclude scan --severity info --diff 4.13.2 .