pyasn1 0.6.4

Source: https://github.com/pyasn1/pyasn1
Artifact scanned: pyasn1-0.6.4-py3-none-any.whl (wheel · 82.4 KB · SHA-256 deda9277cfd4…)
Compared with: pyasn1-0.6.3-py3-none-any.whl (0 signals introduced since)
Files: 34 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 8 info
Scan time: 7.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 8 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 02:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-attribute pyasn1/codec/ber/decoder.py:2235:16

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        warnings.warn(f"{attr} is deprecated. Please use {newAttr} instead.", DeprecationWarning, stacklevel=2)
        return globals()[newAttr]
    raise AttributeError(attr)
```
likely benign LLM, confidence 0.94 A deprecated-name redirect in pyasn1's BER decoder that looks up a renamed symbol in module globals.
Reasoning
The snippet is a module-level __getattr__ deprecation shim: it warns that an old name is deprecated, then returns globals()[newAttr] for a fixed, module-defined rename, and otherwise raises AttributeError. The lookup key comes from the module's own rename table, not untrusted input, so there is no code execution or data exfiltration. This is a standard backward-compatibility pattern in pyasn1.
info ~~warn~~ → info by review dynamic-attribute pyasn1/codec/ber/encoder.py:953:16

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        warnings.warn(f"{attr} is deprecated. Please use {newAttr} instead.", DeprecationWarning, stacklevel=2)
        return globals()[newAttr]
    raise AttributeError(attr)
```
likely benign LLM, confidence 0.94 A deprecated-name redirect in pyasn1's BER encoder that resolves a renamed symbol via globals().
Reasoning
Same module-level __getattr__ deprecation shim as the other pyasn1 codec modules. It emits a DeprecationWarning and resolves a fixed rename through globals(); the key is not attacker-controlled and nothing dangerous is executed.
info ~~warn~~ → info by review dynamic-attribute pyasn1/codec/cer/decoder.py:148:16

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        warnings.warn(f"{attr} is deprecated. Please use {newAttr} instead.", DeprecationWarning, stacklevel=2)
        return globals()[newAttr]
    raise AttributeError(attr)
```
likely benign LLM, confidence 0.94 A deprecated-name redirect in pyasn1's CER decoder using a globals() lookup.
Reasoning
Identical deprecation-redirect __getattr__ pattern: a warning followed by a globals() lookup of a known new name, with AttributeError for anything else. This is a normal compatibility shim with no obfuscation or malicious behaviour.
info ~~warn~~ → info by review dynamic-attribute pyasn1/codec/cer/encoder.py:330:16

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        warnings.warn(f"{attr} is deprecated. Please use {newAttr} instead.", DeprecationWarning, stacklevel=2)
        return globals()[newAttr]
    raise AttributeError(attr)
```
likely benign LLM, confidence 0.94 A deprecated-name redirect in pyasn1's CER encoder via globals().
Reasoning
Same deprecation shim: warns on access to an old name and returns the module attribute for the replacement name. The dynamic lookup is bounded to the module's own symbols, so it is a benign compatibility pattern.
info ~~warn~~ → info by review dynamic-attribute pyasn1/codec/der/decoder.py:119:16

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        warnings.warn(f"{attr} is deprecated. Please use {newAttr} instead.", DeprecationWarning, stacklevel=2)
        return globals()[newAttr]
    raise AttributeError(attr)
```
likely benign LLM, confidence 0.94 A deprecated-name redirect in pyasn1's DER decoder using globals().
Reasoning
Matches the common pyasn1 deprecation-redirect __getattr__. The globals() access resolves a fixed rename and the function raises AttributeError otherwise. It is a legitimate API-migration aid.
info ~~warn~~ → info by review dynamic-attribute pyasn1/codec/der/encoder.py:125:16

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        warnings.warn(f"{attr} is deprecated. Please use {newAttr} instead.", DeprecationWarning, stacklevel=2)
        return globals()[newAttr]
    raise AttributeError(attr)
```
likely benign LLM, confidence 0.94 A deprecated-name redirect in pyasn1's DER encoder via globals().
Reasoning
Same benign module __getattr__ shim that warns on deprecated names and resolves the replacement from the module's globals. Nothing in the snippet is obfuscated or executes external input.
info ~~warn~~ → info by review dynamic-attribute pyasn1/codec/native/decoder.py:243:16

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        warnings.warn(f"{attr} is deprecated. Please use {newAttr} instead.", DeprecationWarning, stacklevel=2)
        return globals()[newAttr]
    raise AttributeError(attr)
```
likely benign LLM, confidence 0.94 A deprecated-name redirect in pyasn1's native decoder via globals().
Reasoning
Standard deprecation-redirect __getattr__ with a fixed mapping to the new name, a DeprecationWarning, and AttributeError fallback. The dynamic attribute access is a known, harmless compatibility mechanism.
info ~~warn~~ → info by review dynamic-attribute pyasn1/codec/native/encoder.py:284:16

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        warnings.warn(f"{attr} is deprecated. Please use {newAttr} instead.", DeprecationWarning, stacklevel=2)
        return globals()[newAttr]
    raise AttributeError(attr)
```
likely benign LLM, confidence 0.94 A deprecated-name redirect in pyasn1's native encoder via globals().
Reasoning
Same deprecation shim in the native encoder: it warns, then returns the module attribute for the new name, and raises AttributeError otherwise. This is ordinary library code with no sign of malicious intent.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pyasn1-0.6.4-py3-none-any.whl https://files.pythonhosted.org/packages/9a/3b/6163796d69c3977d1e4287bea4a6979161cbbdd170ebb430511e8e1999ce/pyasn1-0.6.4-py3-none-any.whl
printf '%s  %s\n' deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b pyasn1-0.6.4-py3-none-any.whl | shasum -a 256 -c -
unzip -q pyasn1-0.6.4-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg