Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO yum install -y python3-devel gcc
$SUDO yum install -y net-tools coreutils-single util-linux sudo procps-ng elif [ $HAS_PACMAN ]; then
$SUDO pacman -S --noconfirm python gcc
-
line length 2954 characters (raw pass, confidence 0.65)
{'LC_NUMERIC': 'it_IT.UTF-8', 'QT_QPA_PLATFORMTHEME': 'appmenu-qt5', 'IM_CONFIG_PHASE': '1', 'XDG_GREETER_DATA_DIR': '/var/lib/lightdm-data/giampaolo', 'XDG_CURRENT_DESKTOP': 'Unity', 'UPSTART_EVENTS': 'started starting', 'GNOME_KEYRING_PID': '', 'XDG_VTNR': '7', 'QT_IM_MODULE': 'ibus', 'LOGNAME': 'giampaolo', 'USE
likely benign
LLM, confidence 0.95
Very long line in psutil documentation containing an example environment dictionary.
Reasoning
A long line in RST documentation containing a captured environment dump (locale, desktop vars) is a formatting issue with no execution or obfuscation risk.
-
line length 513 characters (raw pass, confidence 0.50)
``'cmdline'``, ``'net_connections'``, ``'cpu_affinity'``, ``'cpu_num'``, ``'cpu_percent'``, ``'cpu_times'``, ``'create_time'``, ``'cwd'``, ``'environ'``, ``'exe'``, ``'gids'``, ``'io_counters'``, ``'ionice'``, ``'memory_full_info'``, ``'memory_info'``, ``'memory_maps'``, ``'memory_percent'``, ``'name'``, ``'nice'``
-
`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
fname, lineno, _, _lines, _index = inspect.getframeinfo(
inspect.currentframe().f_back
)
if isinstance(msg, Exception):
likely benign
LLM, confidence 0.93
Uses stack frame introspection to find the caller location for an error message.
Reasoning
inspect.currentframe().f_back is used to report the caller's file and line for error messages, a common legitimate logging/diagnostic idiom in a monitoring library.
-
`os.system` called with a literal shell command (ast pass, confidence 0.70)
if psutil.POSIX:
os.system('clear')
else:
os.system('cls')
likely benign
LLM, confidence 0.95
Clears the terminal via a fixed os.system command on POSIX systems.
Reasoning
os.system('clear') with a fixed literal string in a demo script, selected by platform, is ordinary terminal handling with no external input.
-
`os.system` called with a literal shell command (ast pass, confidence 0.70)
else:
os.system('cls')
likely benign
LLM, confidence 0.95
Clears the Windows console via a fixed os.system('cls') call.
Reasoning
os.system('cls') is a fixed literal Windows clear-screen command in a platform branch; no untrusted input is involved.
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
if [ $HAS_APT ]; then
$SUDO apt-get install -y python3-dev gcc
$SUDO apt-get install -y net-tools coreutils util-linux sudo elif [ $HAS_YUM ]; then
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO apt-get install -y python3-dev gcc
$SUDO apt-get install -y net-tools coreutils util-linux sudo elif [ $HAS_YUM ]; then
$SUDO yum install -y python3-devel gcc
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $HAS_YUM ]; then
$SUDO yum install -y python3-devel gcc
$SUDO yum install -y net-tools coreutils-single util-linux sudo procps-ng elif [ $HAS_PACMAN ]; then
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $HAS_PACMAN ]; then
$SUDO pacman -S --noconfirm python gcc
$SUDO pacman -S --noconfirm net-tools coreutils util-linux sudo elif [ $HAS_APK ]; then
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO pacman -S --noconfirm python gcc
$SUDO pacman -S --noconfirm net-tools coreutils util-linux sudo elif [ $HAS_APK ]; then
$SUDO apk add --no-interactive python3-dev gcc musl-dev linux-headers
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $HAS_APK ]; then
$SUDO apk add --no-interactive python3-dev gcc musl-dev linux-headers
$SUDO apk add --no-interactive coreutils util-linux procps elif [ $FREEBSD ]; then
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO apk add --no-interactive python3-dev gcc musl-dev linux-headers
$SUDO apk add --no-interactive coreutils util-linux procps elif [ $FREEBSD ]; then
$SUDO pkg install -y python3 gcc
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $FREEBSD ]; then
$SUDO pkg install -y python3 gcc
elif [ $NETBSD ]; then
$SUDO /usr/sbin/pkg_add -v pkgin
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $NETBSD ]; then
$SUDO /usr/sbin/pkg_add -v pkgin
$SUDO pkgin update
$SUDO pkgin -y install python311-* gcc12-*
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO /usr/sbin/pkg_add -v pkgin
$SUDO pkgin update
$SUDO pkgin -y install python311-* gcc12-*
elif [ $OPENBSD ]; then
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
$SUDO pkgin update
$SUDO pkgin -y install python311-* gcc12-*
elif [ $OPENBSD ]; then
$SUDO pkg_add gcc python3
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $OPENBSD ]; then
$SUDO pkg_add gcc python3
elif [ $SUNOS ]; then
$SUDO pkg install developer/gcc
-
command name is a variable (`$SUDO`) that this file sets only to plain text (ast pass, confidence 0.40)
elif [ $SUNOS ]; then
$SUDO pkg install developer/gcc
else
echo "Unsupported platform '$UNAME_S'. Ignoring."
-
`os.system` called with a literal shell command (ast pass, confidence 0.70)
code = os.system(
f"{sys.executable} {f.name} --user --upgrade"
" --break-system-packages"
likely benign
LLM, confidence 0.85
Bootstraps pip by running a downloaded installer via os.system with the current interpreter.
Reasoning
Runs get-pip.py-style installer using sys.executable and a temp file name with fixed flags; this is a developer bootstrap script. The interpolated values are local, not attacker-controlled, though shell use via os.system is a minor weakness.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
tcp4_proc = self.pyrun(tcp4_template)
tcp4_addr = eval(wait_for_file(testfile, delete=True))
udp4_proc = self.pyrun(udp4_template)
udp4_addr = eval(wait_for_file(testfile, delete=True))
likely benign
LLM, confidence 0.90
Test evals the address tuple written by a helper subprocess to a temp file.
Reasoning
eval is applied to the content of a test-generated address file written by a subprocess the test itself launched; it is test scaffolding parsing a tuple, not malicious.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
udp4_proc = self.pyrun(udp4_template)
udp4_addr = eval(wait_for_file(testfile, delete=True))
if supports_ipv6():
tcp6_proc = self.pyrun(tcp6_template)
likely benign
LLM, confidence 0.90
Test evals the UDP IPv4 address tuple from a helper's temp file.
Reasoning
Same test pattern: eval of a tuple read from a self-spawned helper's temp file for the UDP address.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
tcp6_proc = self.pyrun(tcp6_template)
tcp6_addr = eval(wait_for_file(testfile, delete=True))
udp6_proc = self.pyrun(udp6_template)
udp6_addr = eval(wait_for_file(testfile, delete=True))
likely benign
LLM, confidence 0.90
Test evals the TCP IPv6 address tuple from a helper's temp file.
Reasoning
Same test-harness eval of the IPv6 TCP address written by a child process the test controls.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
udp6_proc = self.pyrun(udp6_template)
udp6_addr = eval(wait_for_file(testfile, delete=True))
else:
tcp6_proc = None
likely benign
LLM, confidence 0.90
Test evals the UDP IPv6 address tuple from a helper's temp file.
Reasoning
Same test-harness eval of the IPv6 UDP address written by a child process the test controls.
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
try:
__import__(name)
except ImportError:
if name not in psutil.__all__:
likely benign
LLM, confidence 0.85
Test probes whether optional modules can be imported, catching ImportError.
Reasoning
Dynamic __import__ inside try/except ImportError to probe optional module availability is a standard test idiom; the name comes from the test's own iteration, though the critical severity is high for this context.
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io