disclude.ioPyPI / pycryptodome / 4.2.0
pycryptodome 4.2.0
- Source
- https://github.com/Legrandin/pycryptodome
- Artifact scanned
pycryptodome-4.2.0.tar.gz- Compared with
pycryptodome-4.1.0.tar.gz(0 signals introduced since)- Files
- 530 scanned, 54 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 86 info
- Scan time
- 39.7 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 55 of 55 warn and critical signals; 55 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-24 12:28
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
= = %likely benign Sphinx docs config that evals a version_info tuple read from a project file.Reasoning
The eval runs at module scope on a line read from a version file that the project itself ships. That is a common, if poor, way to parse a version tuple in a docs conf. The snippet shows no network, decoding or process activity, so it reads as a legitimate build-time pattern.
-
likely benign A base64-armored public key block embedded in INSTALL documentation.
Reasoning
The base64 lines start with 'mQINBF', the header of an OpenPGP public key block. Public keys in install docs are normal and carry no payload to execute. The raw pass has a high false-positive rate for this kind of text.
-
= 0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED = 0x216936D3CD6E53FEC0A4E231FDD6DC5C692CC7609525A7B2C9562D608F25D51A = 0x6666666666666666666666666666666666666666666666666666666666666658 -
= 0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF = 0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B = 0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551 = 0x6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296 -
# The threaded code is the same for all ciphers: same output as without threads = =likely benign Test helper that dynamically imports a cipher module by name.Reasoning
This is a self-test loop that imports the cipher module named by a loop variable, with keys built per cipher. The name comes from a fixed list in test code, not untrusted input.
-
"""-----BEGIN RSA PRIVATE KEY----- MIICXAIBAAKBgQDAiAnvIAOvqVwJTaYzsKnefZftgtXGE2hPJppGsWl78yz9jeXY W/FxX/gTPURArNhdnhP6n3p2ZaDIBrO2zizbgIXs0IsljTTcr4vnI8fMXzyNUOjA zP3nzMqZDZK6757XQAobOssMkBFqRWwilT/3DsBhRpl3iMUhF+wvpTSHewIDAQABlikely benign An RSA PEM private key used as a fixture in a PKCS#1 test.Reasoning
The blob is an RSA private key in PEM form inside a test string. Test suites carry fixed key material like this, and it is used only to check the implementation.
-
= returnlikely benign Test-vector generator that resolves a digest module by name through globals().Reasoning
The code looks up a digest module by name in globals() while building HMAC test vectors. The names come from the test's own list, so this is ordinary reflection in test generation.
-
=likely benign Base64-encoded RFC 8410 key test vector in PKCS#8 tests.Reasoning
The base64 text is an RFC 8410 test vector for an Ed25519 key in PKCS#8 form. It is standard published test data.
-
= 17**100 = b assert ==likely benign Expected-result byte literal for a modmult assertion in a math test.Reasoning
The byte literal is an expected output value for a modular multiplication check. Binary-looking escapes are normal for test vectors, and the code only compares the result.
-
, -
, -
returnlikely benign Test helper that loads a Crypto.Hash module by name.Reasoning
The helper imports Crypto.Hash submodules by name for KDF tests. The name is supplied by the test suite, and the module is imported without any execution of fetched data.
-
=likely benign An ECC PEM private key fixture for an ECDH test.Reasoning
The blob is an ECC private key in PEM form passed to ECC.import_key in an ECDH test. Fixed key material is expected in this suite.
-
=likely benign ECC PEM private key fixture for ephemeral key import in ECDH tests.Reasoning
This is another ECC PEM private key fixture in the same ECDH test file, used to exercise key import.
-
=likely benign Same ECC PEM ephemeral key fixture, flagged at a second column.Reasoning
This finding repeats the same PEM key literal on the same line as the previous finding, so the reasoning is identical.
-
=likely benign ECC PEM key fixture used in an ECDH test.Reasoning
This is an ECC public/private PEM key fixture used in ECDH test cases. It is test data with no execution path.
-
=likely benign Test fixture containing a PEM-encoded EC private key for ECDH self-tests.Reasoning
A PEM-encoded EC private key embedded as a test fixture in a cryptographic library's self-test suite. Base64 blobs are the normal format for PEM keys; this is an expected, benign pattern.
-
, , , , -
= 0x09FA78B39B00A72930BCD8039BE789A0997830BB99F79AEEB93493715390B4E8 = 0x15210F12786811D3F4B7959D0538AE2C31DBE7106FC03C3EFC4CD549C715A493 -
= 0x09FA78B39B00A72930BCD8039BE789A0997830BB99F79AEEB93493715390B4E8 = 0x15210F12786811D3F4B7959D0538AE2C31DBE7106FC03C3EFC4CD549C715A493 -
= 0x09FA78B39B00A72930BCD8039BE789A0997830BB99F79AEEB93493715390B4E8 = 0x15210F12786811D3F4B7959D0538AE2C31DBE7106FC03C3EFC4CD549C715A493 -
= 0x09FA78B39B00A72930BCD8039BE789A0997830BB99F79AEEB93493715390B4E8 = 0x15210F12786811D3F4B7959D0538AE2C31DBE7106FC03C3EFC4CD549C715A493 -
= -
0xDE2444BEBC8D36E682EDD27E0F271508617519B3221A8FA0B77CAB3989DA97C9, 0xC093AE7FF36E5380FC01A5AAD1E66659702DE80F53CEC576B6350B243042A256, ) -
= -
0x55A8B00F8DA1D44E62F6B3B25316212E39540DC861C89575BB8CF92E35E0986B, 0x5421C3209C2D6C704835D82AC4C3DD90F61A8A52598B9E7AB656E9D8C8B24316, ) -
= 0x72B13DD4354B6B81745195E98CC5BA6970349191AC476BD4553CF35A545A067E = 0x8D585CBB2E1327D75241A8A122D7620DC33B13315AA5C9D46D013011744AC264 -
= 0x72B13DD4354B6B81745195E98CC5BA6970349191AC476BD4553CF35A545A067E = 0x8D585CBB2E1327D75241A8A122D7620DC33B13315AA5C9D46D013011744AC264 -
= 0x7669E6901606EE3BA1A8EEF1E0024C33DF6C22F3B17481B82A860FFCDB6127B0 = 0xFA878162187A54F6C39F6EE0072F33DE389EF3EECD03023DE10CA2C1DB61D0C7 -
= 0x7669E6901606EE3BA1A8EEF1E0024C33DF6C22F3B17481B82A860FFCDB6127B0 = 0xFA878162187A54F6C39F6EE0072F33DE389EF3EECD03023DE10CA2C1DB61D0C7 = -
= 0xC51E4753AFDEC1E6B6C6A5B992F43F8DD0C7A8933072708B6522468B2FFB06FD = 0x51D08D5F2D4278882946D88D83C97D11E62BECC3CFC18BEDACC89BA34EECA03F = 0x75EE68EB8BF626AA5B673AB51F6E744E06F8FCF8A6C0CF3035BECA956A7B41D5 -
= 0x51D08D5F2D4278882946D88D83C97D11E62BECC3CFC18BEDACC89BA34EECA03F = 0x75EE68EB8BF626AA5B673AB51F6E744E06F8FCF8A6C0CF3035BECA956A7B41D5 = * -
= 0xC51E4753AFDEC1E6B6C6A5B992F43F8DD0C7A8933072708B6522468B2FFB06FD = 0xD37F628ECE72A462F0145CBEFE3F0B355EE8332D37ACDD83A358016AEA029DB7 = 0xD867B4679221009234939221B8046245EFCF58413DAACBEFF857B8588341F6B8 -
= 0xD37F628ECE72A462F0145CBEFE3F0B355EE8332D37ACDD83A358016AEA029DB7 = 0xD867B4679221009234939221B8046245EFCF58413DAACBEFF857B8588341F6B8 = 0xF2504055C03CEDE12D22720DAD69C745106B6607EC7E50DD35D54BD80F615275 -
= 0x72B13DD4354B6B81745195E98CC5BA6970349191AC476BD4553CF35A545A067E = 0x8D585CBB2E1327D75241A8A122D7620DC33B13315AA5C9D46D013011744AC264 -
----- ----- / // /2likely benign Test fixture containing a PEM DSA public key.Reasoning
PEM public key block in the PyCryptodome DSA import self-test. Raw base64 flags on PEM content are expected false positives in a crypto library test suite.
-
----- ----- // 7JFWl9p075FPzRsFZg4kGcdh1jn0XS15uALb0j56uLgbR5o4Dh8wkyWEuioLlVAy +likely benign Test fixture containing a PEM DSA private key.Reasoning
PEM DSA private key fixture in a crypto library's import tests; base64 body is the standard encoding and the file is a self-test.
-
----- ----- ///likely benign Test fixture containing a PKCS#8 DSA private key.Reasoning
PEM private key block in a self-test module for DSA key import; standard base64 encoding of ASN.1 structures.
-
=likely benign Test vector containing an OpenSSH DSS public key.Reasoning
OpenSSH ssh-dss public key string used as a test vector for import; base64 is the expected encoding of the SSH wire format.
-
4V6GHRDpCrdZ8MBjbyp5AlGUrjvr2Pn2e2zVxy5RBt4FBj9/ + //+likely benign Part of a PEM key fixture in DSA import tests.Reasoning
Continuation of a PEM key fixture in a crypto library's self-test file; no execution or payload behavior.
-
----- ----- / 7ryiW+5ihtF2Ekurq3e408GYSAu5smJjN2bvQXmzRFBz8W38K8eMf1sbWroZ4+ ++//likely benign Test fixture containing an encrypted PEM private key.Reasoning
Encrypted PKCS#8 private key test fixture; the base64 body is the standard encoding for encrypted PEM keys used in import tests.
-
----- -----likely benign Test fixture containing a PEM X.509 certificate.Reasoning
PEM certificate fixture in a crypto library test file; base64 is the expected encoding of X.509 certificates.
-
info
warn→ info by reviewdynamic-attributelib/Crypto/SelfTest/PublicKey/test_import_DSA.py:511:24= = assert ==likely benign Test helper that retrieves local test strings by name to compare DSA key components.Reasoning
The loop reads local variables named like y_str, p_str by constructed name and then uses getattr on key attributes. This is a test verifying key components with dynamic lookup, a common idiom in test code, with no execution or hidden payload.
-
----- -----likely benign Test fixture containing a PEM X.509 certificate.Reasoning
PEM certificate fixture in a self-test file of a crypto library; standard encoding of an X.509 certificate.
-
info
warn→ info by reviewdynamic-attributelib/Crypto/SelfTest/PublicKey/test_import_DSA.py:594:24= = assert ==likely benign Test helper retrieving local component strings by name to verify DSA key attributes.Reasoning
Same locals-based component lookup as the earlier finding in this test file, used to validate key attributes in a test. Benign test idiom.
-
= assert == 0x5C4E4320EF260F91ED9FC597AEE98C8236B60E0CED692CC7A057D5E45798A052 -
= assert == 0x5C4E4320EF260F91ED9FC597AEE98C8236B60E0CED692CC7A057D5E45798A052 -
= assert == 0x5C4E4320EF260F91ED9FC597AEE98C8236B60E0CED692CC7A057D5E45798A052 -
=likely benign Test fixture containing a PEM EC private key.Reasoning
PEM EC private key string in a crypto library's ECC import test; standard base64 PEM encoding.
-
=likely benign Test fixture containing a PEM EC private key string.Reasoning
This is a PEM-encoded EC private key literal used as test vector in PyCryptodome's self-test suite. Base64 encoding of key material is the expected format; the raw pass flags it only because it is base64-shaped.
-
=likely benign Test fixture containing a PEM EC private key string.Reasoning
Same pattern: a PEM EC private key test vector inside a self-test module, consistent with a crypto library's import tests.
-
=likely benign Test fixture containing a PEM EC private key string.Reasoning
PEM EC private key test vector in a crypto library self-test; base64 blob is the normal encoding of such keys.
-
=likely benign Test fixture containing a PEM EC private key string.Reasoning
PEM EC private key literal used for import testing in the PyCryptodome test suite; expected content, not an obfuscated payload.
-
=likely benign Test fixture containing a PEM EC private key string.Reasoning
PEM EC private key test vector, same context as the other fixtures in this self-test file.
-
=likely benign Test fixture containing a PEM EC private key string.Reasoning
PEM EC private key fixture in a crypto self-test module; the base64 body is standard ASN.1 DER encoding.
-
=likely benign Test fixture containing a PEM EC private key string.Reasoning
PEM EC private key test vector in a legitimate cryptography library test file.
-
=likely benign Test fixture containing a PEM EC private key string.Reasoning
PEM EC private key (P-384 style OID) test fixture; expected base64 content for a key import test.
-
=likely benign Test fixture containing a PEM EC private key string.Reasoning
PEM EC private key test fixture in PyCryptodome's self-tests, a legitimate pattern.
-
=likely benign Test fixture containing a PKCS#8 PEM private key string.Reasoning
PKCS#8 PEM private key (Ed25519/curve OID 1.3.101.112 visible in the DER prefix) used as a test vector for key import; standard encoding.
-
=likely benign Test fixture containing a PEM RSA private key string.Reasoning
RSA private key PEM literal used as a fixture in PyCryptodome's RSA import self-tests; expected content for the library's test suite.
-
=likely benign A PKCS#8 RSA private key PEM literal used as a test vector.Reasoning
The base64 is a PKCS#8 RSA private key embedded as a PEM test vector in a self-test file for a crypto library. Test fixtures like this are expected, and the raw base64 finding is a known false-positive pattern.
-
+ + /+/likely benign Base64 body of another RSA key PEM test vector.Reasoning
Continuation of the same PEM test-vector block in a crypto library self-test. It is ordinary encoded key material in a test, not obfuscation.
-
"""-----BEGIN ENCRYPTED PRIVATE KEY----- MIIBpjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIeZIsbW3O+JcCAggA MBQGCCqGSIb3DQMHBAgSM2p0D8FilgSCAWBhFyP2tiGKVpGj3mO8qIBzinU60ApR 3unvP+N6j7LVgnV2lFGaXbJ6a1PbQXe+2D6DUyBLo8EMXrKKVLqOMGkFMHc0UaV6likely benign Base64 body of an encrypted private key PEM test vector.Reasoning
An encrypted PKCS#8 PEM sample used to test key import. The blob is a standard encrypted key fixture and is expected in this context.
-
=likely benign Base64 body of an RSA public key PEM test vector.Reasoning
A public key PEM literal in a test file for RSA import routines. It is standard fixture data.
-
# Obtained using 'ssh-keygen -i -m PKCS8 -f rsaPublicKeyPEM' = b # The private key, in PKCS#1 format encoded with DERlikely benign An OpenSSH RSA public key string used as a test vector.Reasoning
The literal is an OpenSSH-format RSA public key, annotated in the comment as produced by ssh-keygen. It is a legitimate test vector, and the high compression ratio reflects base64 key data, not hidden code.
-
# Obtained using 'ssh-keygen -i -m PKCS8 -f rsaPublicKeyPEM' = b # The private key, in PKCS#1 format encoded with DERlikely benign Base64 payload of the OpenSSH RSA public key test vector.Reasoning
The same OpenSSH public key literal flagged again as a base64 blob. It is key material in a test with a documented origin.
-
----- -----likely benign Base64 body of an X.509 certificate PEM test fixture.Reasoning
A PEM certificate used to test certificate parsing in a crypto library's self-tests. The subject strings are readable test data, consistent with a fixture.
-
----- -----likely benign Base64 body of a test X.509 certificate PEM.Reasoning
A longer certificate PEM fixture with a recognizable test CA subject ('Test CA', example.com). This is standard test data for a crypto library.
-
returnlikely benign A test helper that dynamically imports a Crypto.Hash submodule chosen by name.Reasoning
The __import__ call builds the module name from a fixed 'Crypto.Hash.' prefix plus a hash name passed by the test harness. The pattern is a dynamic import, but the target is confined to the package's own hash modules and the call is used only to select hash implementations in self-tests. It is a legitimate test helper, not a dropper.
-
=likely benign Base64 body of an EC public key PEM test vector.Reasoning
A base64 EC public key PEM literal in a DSS signature test. It is expected test-vector content.
-
= = -
, , , -
returnlikely benign A test helper that dynamically imports a Crypto.Hash submodule chosen by name.Reasoning
The same hash-name dynamic import helper as in test_dss.py. The prefix is fixed and the input comes from the test suite, so it is a legitimate self-test pattern.
-
=likely benign Base64 body of an RSA private key PEM test vector.Reasoning
A PKCS#1 RSA private key PEM literal used in a PKCS#1 v1.5 signature test. It is standard test key material.
-
returnlikely benign Test helper that dynamically imports a Crypto.Hash module by name.Reasoning
This is a test helper that dynamically imports Crypto.Hash submodules by name, a common pattern in PyCryptodome self-tests. The argument is a hash name from test vectors, not untrusted input, so the dynamic import is legitimate here though it matches the AST signal.
-
= blikely benign Test vector containing a PEM-encoded RSA private key in a self-test.Reasoning
The raw pass flagged an embedded RSA private key in a test vector. This is a known test key in a cryptography library's self-test, not an obfuscated payload; the base64-like lines are PEM content.
-
= blikely benign Binary known-answer test vector written as hex escapes.Reasoning
A bytes literal with many \x escapes is a binary test vector (a signature/tag value) in a crypto test file. Hex-escaped binary constants are normal for known-answer tests.
-
= returnlikely benign Self-test dynamically imports a Crypto.Hash module to exercise XOF behavior.Reasoning
Dynamic import of Crypto.Hash.<name> in a self-test for XOF hashes, with name drawn from a fixed test list. Legitimate test code pattern, though the AST rule flags it by design.
-
likely benign Portability macro mapping inline to a compiler-specific spelling.
Reasoning
Redefining inline to _inline is a portability shim for compilers that lack the keyword in C89 mode, typically paired with a conditional block. It is a common legitimate header pattern, though it does rebind a reserved keyword.
-
likely benign Portability macro mapping inline to __inline for a specific compiler branch.
Reasoning
Same portability pattern as the earlier definition, mapping inline to __inline in an alternate compiler branch. Consistent with standard MSVC/C89 compatibility headers.
-
const uint8_t Gx = "\x21\x69\x36\xd3\xcd\x6e\x53\xfe\xc0\xa4\xe2\x31\xfd\xd6\xdc\x5c\x69\x2c\xc7\x60\x95\x25\xa7\xb2\xc9\x56\x2d\x60\x8f\x25\xd5\x1a"; const uint8_t Gy = "\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x58";likely benign Ed25519 base point coordinate constants written as byte escapes.Reasoning
Hex escape strings encode the Ed25519 base point coordinates Gx and Gy as constants. This is a known curve constant, not a hidden payload, so the raw entropy flag is a false positive.
-
const word_t a = ; word_t ar, lo, hi; /** Their reflections (by linearity for the third one) **/likely benign Short local array names that the confusable-identifier check considers colliding.Reasoning
The two identifiers flagged are short local arrays (lo, hi, ar) whose skeleton collision with a similar name is an artifact of the confusability check on short identifiers. Within a GHASH implementation the naming is ordinary, with no sign of a trojan-source attack.
-
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&