Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO yum install -y python3-devel gcc
$SUDO yum install -y net-tools coreutils-single util-linux sudo procps-ng elif [ $HAS_PACMAN ]; then
$SUDO pacman -S --noconfirm python gcc
-
file mixes tab and space indentation (1 tab-indented and 123 space-indented lines) (raw pass, confidence 0.40)
$(function() {
-
line length 2954 characters (raw pass, confidence 0.65)
{'LC_NUMERIC': 'it_IT.UTF-8', 'QT_QPA_PLATFORMTHEME': 'appmenu-qt5', 'IM_CONFIG_PHASE': '1', 'XDG_GREETER_DATA_DIR': '/var/lib/lightdm-data/giampaolo', 'XDG_CURRENT_DESKTOP': 'Unity', 'UPSTART_EVENTS': 'started starting', 'GNOME_KEYRING_PID': '', 'XDG_VTNR': '7', 'QT_IM_MODULE': 'ibus', 'LOGNAME': 'giampaolo', 'USE
likely benign
LLM, confidence 0.97
A very long line in psutil documentation showing a captured environment dictionary example.
Reasoning
Raw long-line finding in RST docs containing an environment variable dump example. No obfuscation or malicious intent; long lines in documentation are common.
-
line length 513 characters (raw pass, confidence 0.50)
``'cmdline'``, ``'net_connections'``, ``'cpu_affinity'``, ``'cpu_num'``, ``'cpu_percent'``, ``'cpu_times'``, ``'create_time'``, ``'cwd'``, ``'environ'``, ``'exe'``, ``'gids'``, ``'io_counters'``, ``'ionice'``, ``'memory_full_info'``, ``'memory_info'``, ``'memory_maps'``, ``'memory_percent'``, ``'name'``, ``'nice'``
-
`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
fname, lineno, _, _lines, _index = inspect.getframeinfo(
inspect.currentframe().f_back
)
if isinstance(msg, Exception):
likely benign
LLM, confidence 0.92
Uses call-stack introspection to report the caller's filename and line number in psutil's common utilities.
Reasoning
inspect.currentframe().f_back is used to find the caller's file and line for error reporting in a library warning/exception helper. This is a standard, legitimate debugging/logging idiom.
-
`os.system` called with a literal shell command (ast pass, confidence 0.70)
if psutil.POSIX:
os.system('clear')
else:
os.system('cls')
likely benign
LLM, confidence 0.95
Clears the terminal using a platform-specific literal shell command in a helper script.
Reasoning
os.system with hardcoded 'clear' or 'cls' chosen by platform in a developer script. Literal commands with no external input; benign.
-
`os.system` called with a literal shell command (ast pass, confidence 0.70)
else:
os.system('cls')
likely benign
LLM, confidence 0.95
Runs the Windows 'cls' command to clear the terminal in a developer script.
Reasoning
Same pattern as the sibling finding: a literal 'cls' command in the Windows branch of a terminal-clearing helper. No untrusted input is involved.
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
if [ $HAS_APT ]; then
$SUDO apt-get install -y python3-dev gcc
$SUDO apt-get install -y net-tools coreutils util-linux sudo elif [ $HAS_YUM ]; then
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO apt-get install -y python3-dev gcc
$SUDO apt-get install -y net-tools coreutils util-linux sudo elif [ $HAS_YUM ]; then
$SUDO yum install -y python3-devel gcc
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $HAS_YUM ]; then
$SUDO yum install -y python3-devel gcc
$SUDO yum install -y net-tools coreutils-single util-linux sudo procps-ng elif [ $HAS_PACMAN ]; then
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $HAS_PACMAN ]; then
$SUDO pacman -S --noconfirm python gcc
$SUDO pacman -S --noconfirm net-tools coreutils util-linux sudo elif [ $HAS_APK ]; then
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO pacman -S --noconfirm python gcc
$SUDO pacman -S --noconfirm net-tools coreutils util-linux sudo elif [ $HAS_APK ]; then
$SUDO apk add --no-interactive python3-dev gcc musl-dev linux-headers
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $HAS_APK ]; then
$SUDO apk add --no-interactive python3-dev gcc musl-dev linux-headers
$SUDO apk add --no-interactive coreutils util-linux procps elif [ $FREEBSD ]; then
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO apk add --no-interactive python3-dev gcc musl-dev linux-headers
$SUDO apk add --no-interactive coreutils util-linux procps elif [ $FREEBSD ]; then
$SUDO pkg install -y python3 gcc
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $FREEBSD ]; then
$SUDO pkg install -y python3 gcc
elif [ $NETBSD ]; then
$SUDO /usr/sbin/pkg_add -v pkgin
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $NETBSD ]; then
$SUDO /usr/sbin/pkg_add -v pkgin
$SUDO pkgin update
$SUDO pkgin -y install python311-* gcc12-*
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO /usr/sbin/pkg_add -v pkgin
$SUDO pkgin update
$SUDO pkgin -y install python311-* gcc12-*
elif [ $OPENBSD ]; then
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO pkgin update
$SUDO pkgin -y install python311-* gcc12-*
elif [ $OPENBSD ]; then
$SUDO pkg_add gcc python3
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $OPENBSD ]; then
$SUDO pkg_add gcc python3
elif [ $SUNOS ]; then
$SUDO pkg install developer/gcc
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $SUNOS ]; then
$SUDO pkg install developer/gcc
else
echo "Unsupported platform '$UNAME_S'. Ignoring."
-
`os.system` called with a literal shell command (ast pass, confidence 0.70)
code = os.system(
f"{sys.executable} {f.name} --user --upgrade"
" --break-system-packages"
likely benign
LLM, confidence 0.90
Runs a pip upgrade via os.system using the current Python interpreter and a temporary script file.
Reasoning
os.system runs sys.executable with a temp file name to install pip with --user and --upgrade. The command is built from interpreter and temp file paths, not remote input. It is a legitimate bootstrap step, though shell string building is worth a minor note.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
tcp4_proc = self.pyrun(tcp4_template)
tcp4_addr = eval(wait_for_file(testfile, delete=True))
udp4_proc = self.pyrun(udp4_template)
udp4_addr = eval(wait_for_file(testfile, delete=True))
likely benign
LLM, confidence 0.85
Evaluates the address tuple written by a child test process to a temporary file.
Reasoning
eval on output read from a test-generated temp file containing a Python address tuple. Test-only code; the eval is unsafe in general but the input is produced locally by the test's own subprocess.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
udp4_proc = self.pyrun(udp4_template)
udp4_addr = eval(wait_for_file(testfile, delete=True))
if supports_ipv6():
tcp6_proc = self.pyrun(tcp6_template)
likely benign
LLM, confidence 0.85
Evaluates the UDP IPv4 address tuple written by a child test process.
Reasoning
Same test-only eval of locally generated address data read from a temp file. Not a malicious pattern.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
tcp6_proc = self.pyrun(tcp6_template)
tcp6_addr = eval(wait_for_file(testfile, delete=True))
udp6_proc = self.pyrun(udp6_template)
udp6_addr = eval(wait_for_file(testfile, delete=True))
likely benign
LLM, confidence 0.85
Evaluates the TCP IPv6 address tuple written by a child test process.
Reasoning
Same test-only eval pattern for IPv6 TCP address data produced by the test harness.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
udp6_proc = self.pyrun(udp6_template)
udp6_addr = eval(wait_for_file(testfile, delete=True))
else:
tcp6_proc = None
likely benign
LLM, confidence 0.85
Evaluates the UDP IPv6 address tuple written by a child test process.
Reasoning
Same test-only eval pattern for IPv6 UDP address data produced by the test harness.
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
try:
__import__(name)
except ImportError:
if name not in psutil.__all__:
likely benign
LLM, confidence 0.80
Dynamically imports a module name inside a test to check for optional dependencies.
Reasoning
Critical severity is overstated: __import__(name) inside a try/except ImportError in a test checking optional module availability and psutil.__all__. The dynamic name comes from a test-controlled list, so this is a normal idiom rather than a dropper.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io