psutil 7.2.2

Source: https://github.com/giampaolo/psutil
Tag scanned: v7.2.2
Compared with: v7.2.1 (1 signals introduced since)
Files: 189 scanned, 23 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 26 info
Scan time: 7.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 01:22

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution scripts/internal/install-sysdeps.sh:50:9 new in this release

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

        $SUDO yum install -y python3-devel gcc
        $SUDO yum install -y net-tools coreutils-single util-linux sudo procps-ng  # for tests
    elif [ $HAS_PACMAN ]; then
        $SUDO pacman -S --noconfirm python gcc

info whitespace-anomaly docs/_static/sidebar.js:24:1

file mixes tab and space indentation (1 tab-indented and 123 space-indented lines) (raw pass, confidence 0.40)

$(function() {
  // global elements used by the functions.
  // the 'sidebarbutton' element is defined as global after its
  // creation, in the add_sidebar_button function

info ~~warn~~ → info by review long-line docs/index.rst:1227:1

line length 2954 characters (raw pass, confidence 0.65)
```
    {'LC_NUMERIC': 'it_IT.UTF-8', 'QT_QPA_PLATFORMTHEME': 'appmenu-qt5', 'IM_CONFIG_PHASE': '1', 'XDG_GREETER_DATA_DIR': '/var/lib/lightdm-data/giampaolo', 'XDG_CURRENT_DESKTOP': 'Unity', 'UPSTART_EVENTS': 'started starting', 'GNOME_KEYRING_PID': '', 'XDG_VTNR': '7', 'QT_IM_MODULE': 'ibus', 'LOGNAME': 'giampaolo', 'USE
```
likely benign LLM, confidence 0.97 Long line in psutil docs containing a sample environment variable dictionary.
Reasoning
A very long line in reStructuredText documentation containing an environment dump example is a formatting artifact, not obfuscation or malicious code.

info long-line docs/index.rst:1260:1

line length 513 characters (raw pass, confidence 0.50)

    ``'cmdline'``, ``'net_connections'``, ``'cpu_affinity'``, ``'cpu_num'``, ``'cpu_percent'``, ``'cpu_times'``, ``'create_time'``, ``'cwd'``, ``'environ'``, ``'exe'``, ``'gids'``, ``'io_counters'``, ``'ionice'``, ``'memory_full_info'``, ``'memory_info'``, ``'memory_maps'``, ``'memory_percent'``, ``'name'``, ``'nice'``

info ~~warn~~ → info by review frame-introspection psutil/_common.py:851:13

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        fname, lineno, _, _lines, _index = inspect.getframeinfo(
            inspect.currentframe().f_back
        )
        if isinstance(msg, Exception):
```
likely benign LLM, confidence 0.95 Uses frame introspection to report the caller's file and line for a warning message.
Reasoning
inspect.currentframe().f_back is used to get the caller's file and line number for error reporting in a monitoring library. This is a standard, legitimate debugging/logging technique.
info ~~warn~~ → info by review dynamic-execution scripts/cpu_distribution.py:55:9

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
    if psutil.POSIX:
        os.system('clear')
    else:
        os.system('cls')
```
likely benign LLM, confidence 0.95 Clears the terminal screen using a literal os.system call based on platform.
Reasoning
os.system with fixed literal 'clear' or 'cls' to clear the terminal in a demo script is benign and has no external input.
info ~~warn~~ → info by review dynamic-execution scripts/cpu_distribution.py:57:9

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
    else:
        os.system('cls')
```
likely benign LLM, confidence 0.95 Clears the terminal on Windows using a literal os.system('cls') call.
Reasoning
Same as the sibling finding: a literal 'cls' command for Windows terminal clearing in a script, with no untrusted input.

info dynamic-execution scripts/internal/install-sysdeps.sh:46:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

    if [ $HAS_APT ]; then
        $SUDO apt-get install -y python3-dev gcc
        $SUDO apt-get install -y net-tools coreutils util-linux sudo  # for tests
    elif [ $HAS_YUM ]; then

info dynamic-execution scripts/internal/install-sysdeps.sh:47:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

        $SUDO apt-get install -y python3-dev gcc
        $SUDO apt-get install -y net-tools coreutils util-linux sudo  # for tests
    elif [ $HAS_YUM ]; then
        $SUDO yum install -y python3-devel gcc

info dynamic-execution scripts/internal/install-sysdeps.sh:49:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

    elif [ $HAS_YUM ]; then
        $SUDO yum install -y python3-devel gcc
        $SUDO yum install -y net-tools coreutils-single util-linux sudo procps-ng  # for tests
    elif [ $HAS_PACMAN ]; then

info dynamic-execution scripts/internal/install-sysdeps.sh:52:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

    elif [ $HAS_PACMAN ]; then
        $SUDO pacman -S --noconfirm python gcc
        $SUDO pacman -S --noconfirm net-tools coreutils util-linux sudo  # for tests
    elif [ $HAS_APK ]; then

info dynamic-execution scripts/internal/install-sysdeps.sh:53:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

        $SUDO pacman -S --noconfirm python gcc
        $SUDO pacman -S --noconfirm net-tools coreutils util-linux sudo  # for tests
    elif [ $HAS_APK ]; then
        $SUDO apk add --no-interactive python3-dev gcc musl-dev linux-headers

info dynamic-execution scripts/internal/install-sysdeps.sh:55:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

    elif [ $HAS_APK ]; then
        $SUDO apk add --no-interactive python3-dev gcc musl-dev linux-headers
        $SUDO apk add --no-interactive coreutils util-linux procps  # for tests
    elif [ $FREEBSD ]; then

info dynamic-execution scripts/internal/install-sysdeps.sh:56:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

        $SUDO apk add --no-interactive python3-dev gcc musl-dev linux-headers
        $SUDO apk add --no-interactive coreutils util-linux procps  # for tests
    elif [ $FREEBSD ]; then
        $SUDO pkg install -y python3 gcc

info dynamic-execution scripts/internal/install-sysdeps.sh:58:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

    elif [ $FREEBSD ]; then
        $SUDO pkg install -y python3 gcc
    elif [ $NETBSD ]; then
        $SUDO /usr/sbin/pkg_add -v pkgin

info dynamic-execution scripts/internal/install-sysdeps.sh:60:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

    elif [ $NETBSD ]; then
        $SUDO /usr/sbin/pkg_add -v pkgin
        $SUDO pkgin update
        $SUDO pkgin -y install python311-* gcc12-*

info dynamic-execution scripts/internal/install-sysdeps.sh:61:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

        $SUDO /usr/sbin/pkg_add -v pkgin
        $SUDO pkgin update
        $SUDO pkgin -y install python311-* gcc12-*
    elif [ $OPENBSD ]; then

info dynamic-execution scripts/internal/install-sysdeps.sh:62:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

        $SUDO pkgin update
        $SUDO pkgin -y install python311-* gcc12-*
    elif [ $OPENBSD ]; then
        $SUDO pkg_add gcc python3

info dynamic-execution scripts/internal/install-sysdeps.sh:64:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

    elif [ $OPENBSD ]; then
        $SUDO pkg_add gcc python3
    elif [ $SUNOS ]; then
        $SUDO pkg install developer/gcc

info dynamic-execution scripts/internal/install-sysdeps.sh:66:9

command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)

    elif [ $SUNOS ]; then
        $SUDO pkg install developer/gcc
    else
        echo "Unsupported platform '$UNAME_S'. Ignoring."

info ~~warn~~ → info by review dynamic-execution scripts/internal/install_pip.py:42:16

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
        code = os.system(
            f"{sys.executable} {f.name} --user --upgrade"
            " --break-system-packages"
```
likely benign LLM, confidence 0.85 Invokes pip install through os.system using the current interpreter and a downloaded get-pip script.
Reasoning
Runs pip via os.system with sys.executable and a temp file name. Interpolated values are not attacker-controlled in a normal install flow, though the shell-string construction is a minor hygiene concern.
info ~~warn~~ → info by review dynamic-execution tests/test_connections.py:363:21

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        tcp4_proc = self.pyrun(tcp4_template)
        tcp4_addr = eval(wait_for_file(testfile, delete=True))
        udp4_proc = self.pyrun(udp4_template)
        udp4_addr = eval(wait_for_file(testfile, delete=True))
```
likely benign LLM, confidence 0.93 Evaluates the address tuple written by a child test process to a temp file.
Reasoning
eval on the contents of a test-helper temp file that the test itself writes, containing a Python address tuple. This is a test-only pattern with no external attacker input.
info ~~warn~~ → info by review dynamic-execution tests/test_connections.py:365:21

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        udp4_proc = self.pyrun(udp4_template)
        udp4_addr = eval(wait_for_file(testfile, delete=True))
        if supports_ipv6():
            tcp6_proc = self.pyrun(tcp6_template)
```
likely benign LLM, confidence 0.93 Evaluates a test-generated address tuple read from a temp file.
Reasoning
Same test-only eval of a self-written temp file containing a socket address tuple.
info ~~warn~~ → info by review dynamic-execution tests/test_connections.py:368:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            tcp6_proc = self.pyrun(tcp6_template)
            tcp6_addr = eval(wait_for_file(testfile, delete=True))
            udp6_proc = self.pyrun(udp6_template)
            udp6_addr = eval(wait_for_file(testfile, delete=True))
```
likely benign LLM, confidence 0.93 Evaluates a test-generated IPv6 address tuple read from a temp file.
Reasoning
Same test-only eval of a self-written temp file in the IPv6 branch of the test.
info ~~warn~~ → info by review dynamic-execution tests/test_connections.py:370:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            udp6_proc = self.pyrun(udp6_template)
            udp6_addr = eval(wait_for_file(testfile, delete=True))
        else:
            tcp6_proc = None
```
likely benign LLM, confidence 0.93 Evaluates a test-generated IPv6 address tuple read from a temp file.
Reasoning
Same test-only eval of a self-written temp file in the IPv6 branch of the test.
info ~~critical~~ → info by review dynamic-import tests/test_misc.py:210:21

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
                try:
                    __import__(name)
                except ImportError:
                    if name not in psutil.__all__:
```
likely benign LLM, confidence 0.90 Dynamically imports module names in a test to check for optional dependencies.
Reasoning
__import__ on a name from a loop over module names in a test checking importability of optional dependencies. Standard test idiom; the critical severity is overstated for this context.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/giampaolo/psutil psutil && cd psutil
git checkout v7.2.2
disclude scan --severity info --diff v7.2.1 .