pymupdf 2.0

Source: https://github.com/pymupdf/pymupdf
Artifact scanned: pymupdf-2.0.tar.gz (sdist · 84.7 MB · SHA-256 7733136f626f…)
Compared with: pymupdf-1.28.2.tar.gz (71 signals introduced since)
Files: 116 scanned, 303 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 80 info
Scan time: 58.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 76 of 76 warn and critical signals; 76 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 10:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:109:45 new in this release

bytes literal contains 87 `\xNN` escapes (98% of content) — binary payload shape (ast pass, confidence 0.85)
```
                            ['2023', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8
```
likely benign LLM, confidence 0.90 A test fixture stores Chinese text as UTF-8 bytes literals.
Reasoning
The bytes literal is UTF-8 encoded Chinese prose, a typical text fixture for testing decoding of non-ASCII table content. It is data in a test, not an executable payload.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:109:47 new in this release

27 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.80)
```
                            ['2023', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8
```
likely benign LLM, confidence 0.90 Consecutive UTF-8 escapes encoding Chinese text in a test fixture.
Reasoning
The escape sequences encode readable Chinese sentences in UTF-8 and are decoded in the test. This is a benign text fixture pattern.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:109:232 new in this release

21 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
e5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa
```
likely benign LLM, confidence 0.90 A run of escaped UTF-8 bytes forming Chinese text in a test.
Reasoning
The run of \x escapes is the UTF-8 encoding of Chinese text used as test data and decoded with .decode(). It is not obfuscated code.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:109:317 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
4\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\x
```
likely benign LLM, confidence 0.90 Escaped UTF-8 Chinese text within a test data literal.
Reasoning
Same benign UTF-8 Chinese text fixture as the surrounding test data, decoded in the test. The raw-pass hit is a false positive from the escape density.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:109:415 new in this release

bytes literal contains 78 `\xNN` escapes (97% of content) — binary payload shape (ast pass, confidence 0.85)
```
\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xb
```
likely benign LLM, confidence 0.90 A bytes literal of Chinese text used as test data.
Reasoning
This bytes literal is again UTF-8 Chinese prose used as test fixture data, decoded with .decode(). The payload-shape heuristic fires on the escape density, not on any executable content.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:109:417 new in this release

18 consecutive `\xNN` escapes (entropy 3.7 bits/byte) (raw pass, confidence 0.65)
```
e5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\
```
likely benign LLM, confidence 0.90 Escaped UTF-8 Chinese text in a test fixture.
Reasoning
The escape run is UTF-8 encoded Chinese text in a test fixture. The raw entropy flag reflects the multibyte encoding, not hidden content.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:109:491 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\n\xe5\x8f\xb8'.decode(), b'\xe7\xa
```
likely benign LLM, confidence 0.90 Another escaped UTF-8 Chinese text segment in the test fixture.
Reasoning
This is a continuation of the same Chinese text fixture, decoded in the test. It is benign data, and the raw pass flags it only because of the byte-escape density.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:109:654 new in this release

18 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.65)
```
e8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\n\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode(), ],
```
likely benign LLM, confidence 0.90 A final escaped UTF-8 Chinese text fragment in the test fixture.
Reasoning
The escaped bytes are UTF-8 Chinese text, followed by a decode call in a test table. This is a legitimate fixture with no executable or obfuscated behavior.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:110:45 new in this release

bytes literal contains 87 `\xNN` escapes (98% of content) — binary payload shape (ast pass, confidence 0.85)
```
                            ['2022', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8
```
likely benign LLM, confidence 0.92 Test fixture holding Chinese text as UTF-8 byte escapes in a table of ratings.
Reasoning
The bytes literal is UTF-8 encoded Chinese prose (credit-rating disclaimers and risk text) inside a test fixture with rating strings like 'AA+'. The escapes are a plain encoding of human-readable text, not a payload. The AST shape flag is a false positive for this data.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:110:47 new in this release

27 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.80)
```
                            ['2022', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8
```
likely benign LLM, confidence 0.92 Consecutive \xNN escapes encoding Chinese UTF-8 text in a test fixture.
Reasoning
The raw-pass escape run is the same UTF-8 encoding of Chinese text in a test data table. Byte escapes for non-ASCII strings are a common way to write such fixtures, and nothing is decoded and executed beyond a .decode() to text.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:110:232 new in this release

21 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
e5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa
```
likely benign LLM, confidence 0.92 Escape run within a Chinese text fixture in test data.
Reasoning
This is another run of UTF-8 escapes inside the same Chinese-language test fixture, consistent with encoded natural-language text (e.g., disclaimer phrases). It is not an encoded blob or executable content.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:110:317 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
4\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\x
```
likely benign LLM, confidence 0.92 Escape run of UTF-8 Chinese text in a test fixture.
Reasoning
The escapes sit in the same test table as the Chinese disclaimer strings and decode to ordinary prose. The raw entropy reflects UTF-8 multibyte characters, not encryption or obfuscation.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:110:415 new in this release

bytes literal contains 78 `\xNN` escapes (97% of content) — binary payload shape (ast pass, confidence 0.85)
```
\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xb
```
likely benign LLM, confidence 0.92 Bytes literal of Chinese text decoded in a test table.
Reasoning
The bytes literal is one of several UTF-8 Chinese text fields in a test data table, each explicitly decoded to str. The 'binary payload shape' heuristic misreads multibyte text as binary data.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:110:417 new in this release

18 consecutive `\xNN` escapes (entropy 3.7 bits/byte) (raw pass, confidence 0.65)
```
e5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\
```
likely benign LLM, confidence 0.92 UTF-8 escape run in a Chinese-language test fixture.
Reasoning
This is the same kind of UTF-8 escape run in the Chinese text fixture. The surrounding code only decodes these literals to strings, with no execution or network activity.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:110:491 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\n\xe5\x8f\xb8'.decode(), b'\xe7\xa
```
likely benign LLM, confidence 0.92 Escape run of Chinese prose within test data.
Reasoning
The escapes continue the Chinese disclaimer text in a test data structure and decode to readable content. No dynamic execution or suspicious construction is present in the snippet.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:110:654 new in this release

18 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.65)
```
e8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\n\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode(), ],
```
likely benign LLM, confidence 0.90 Short UTF-8 bytes literal decoded to a Chinese word in a test list.
Reasoning
The snippet shows a .decode() of UTF-8 bytes for the Chinese word for 'stable' within the same test list. This is ordinary text fixture encoding.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:111:45 new in this release

bytes literal contains 87 `\xNN` escapes (98% of content) — binary payload shape (ast pass, confidence 0.85)
```
                            ['2021', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8
```
likely benign LLM, confidence 0.92 Bytes literal of Chinese text in the 2021 row of a test table.
Reasoning
This mirrors the 110 line: a 2021 row in the same test table containing UTF-8 Chinese text as byte escapes. It is test data, and the payload-shape flag is triggered by the escape density alone.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:111:47 new in this release

27 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.80)
```
                            ['2021', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8
```
likely benign LLM, confidence 0.92 UTF-8 escape run of Chinese text in a test fixture row.
Reasoning
The escape run is the same UTF-8 encoding of Chinese text in the 2021 test row. It is a legitimate fixture pattern with no execution or decoding beyond text conversion.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:111:232 new in this release

21 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
e5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x8
```
likely benign LLM, confidence 0.95 Chinese text written as UTF-8 byte escapes and decoded in a test file.
Reasoning
UTF-8 Chinese text encoded as byte escapes inside a test fixture that decodes to human-readable Chinese financial-table strings; a legitimate i18n test pattern, not obfuscation.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:111:317 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
4\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode()
```
likely benign LLM, confidence 0.95 Chinese UTF-8 byte literals decoded to strings in a test.
Reasoning
Same pattern: UTF-8 bytes for Chinese strings in a test fixture, decoded immediately; benign localization test data.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:111:417 new in this release

18 consecutive `\xNN` escapes (entropy 3.7 bits/byte) (raw pass, confidence 0.65)
```
e5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode(), ],
```
likely benign LLM, confidence 0.95 Chinese UTF-8 byte literals decoded in a test fixture.
Reasoning
Chinese UTF-8 byte literals with .decode() in a test fixture; benign encoding of human-readable text.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:112:45 new in this release

bytes literal contains 87 `\xNN` escapes (98% of content) — binary payload shape (ast pass, confidence 0.85)
```
                            ['2020', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8
```
likely benign LLM, confidence 0.95 Bytes literal holding UTF-8 Chinese text in a test data table.
Reasoning
The bytes literal is UTF-8 encoded Chinese prose (financial/insurance wording) within a test data table, not a binary payload; the AST shape heuristic is triggered by byte escapes alone.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:112:47 new in this release

27 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.80)
```
                            ['2020', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8
```
likely benign LLM, confidence 0.95 Long run of UTF-8 byte escapes encoding Chinese text in tests.
Reasoning
Escape soup is UTF-8 Chinese text in a test fixture; the raw heuristic fires on non-ASCII byte escapes, which is expected for multilingual test data.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:112:232 new in this release

21 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
e5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x8
```
likely benign LLM, confidence 0.95 Chinese UTF-8 byte escapes in a test table.
Reasoning
Same file and pattern: UTF-8 Chinese text as byte escapes in test data, decoded to strings.

info ~~warn~~ → info by review encoding-hex tests/test_tables.py:112:317 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)

4\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode()

likely benign LLM, confidence 0.95 Chinese UTF-8 byte literals decoded in a test.

Reasoning

UTF-8 Chinese byte literals decoded in a test fixture; benign.

info ~~warn~~ → info by review encoding-hex tests/test_tables.py:112:417 new in this release

18 consecutive `\xNN` escapes (entropy 3.7 bits/byte) (raw pass, confidence 0.65)
```
e5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode(), ],
```
likely benign LLM, confidence 0.95 Chinese UTF-8 byte literals decoded in a test.
Reasoning
UTF-8 Chinese byte literals with decode() in test data; benign.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:115:70 new in this release

18 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
         [b'\xe5\xba\x8f\xe5\x8f\xb7'.decode(), b'\xe9\x87\x91\xe8\x9e\x8d\xe6\x9c\xba\xe6\x9e\x84\xe5\x90\x8d\xe7\xa7\xb0'.decode(), b'\xe6\x8e\x88\xe4\xbf\xa1\xe6\x80\xbb\xe9\xa2\x9d'.decode(), b'\xe5\xb7\xb2\xe4\xbd\xbf\xe7\x94\xa8\xe6\x83\x85\xe5\x86\xb5'.decode(), b'\xe5\x89\xa9\xe4\xbd\x99\xe9\xa2\x9d\xe5\xba\xa6
```
likely benign LLM, confidence 0.95 Chinese table header labels encoded as byte literals and decoded.
Reasoning
Chinese column headers (序号, 金融机构名称, etc.) encoded as UTF-8 bytes and decoded in a test; legitimate localized test data.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:117:35 new in this release

bytes literal contains 36 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
                            ['2', b'\xe5\xbe\xbd\xe5\x95\x86\xe9\x93\xb6\xe8\xa1\x8c\xe5\x8d\x97\xe4\xba\xac\xe4\xb8\xad\xe5\xb1\xb1\xe5\x8c\x97\xe8\xb7\xaf\xe6\x94\xaf\xe8\xa1\x8c'.decode(), '33043530\n, .', '25673530\n, .', '7370000\n, .', ],
```
likely benign LLM, confidence 0.93 Bytes literal holding a Chinese bank name in test data.
Reasoning
The bytes literal decodes to Chinese bank name text (徽商银行南京中山北路支行) inside a test table; the binary-payload shape is a false positive on UTF-8 text.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:117:37 new in this release

36 consecutive `\xNN` escapes (entropy 4.3 bits/byte) (raw pass, confidence 0.80)
```
                            ['2', b'\xe5\xbe\xbd\xe5\x95\x86\xe9\x93\xb6\xe8\xa1\x8c\xe5\x8d\x97\xe4\xba\xac\xe4\xb8\xad\xe5\xb1\xb1\xe5\x8c\x97\xe8\xb7\xaf\xe6\x94\xaf\xe8\xa1\x8c'.decode(), '33043530\n, .', '25673530\n, .', '7370000\n, .', ],
```
likely benign LLM, confidence 0.93 UTF-8 byte escapes encoding a Chinese bank name in a test.
Reasoning
Escape run is UTF-8 Chinese bank-name text decoded in a test fixture; benign non-ASCII test data.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:118:37 new in this release

24 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.80)
```
                            ['3', b'\xe5\x85\xb4\xe4\xb8\x9a\xe9\x93\xb6\xe8\xa1\x8c\xe7\x9b\x90\xe5\x9f\x8e\xe5\x88\x86\xe8\xa1\x8c'.decode(), '30260000\n, .', '11060000\n, .', '19200000\n, .', ],
```
likely benign LLM, confidence 0.90 Test fixture holding a UTF-8 Chinese bank name written as byte escapes.
Reasoning
The escapes decode to UTF-8 Chinese bank-name text ("兴业银行盐城分行") inside a test table fixture. Raw-pass escape runs in a test file holding localized strings are a common legitimate pattern and carry no execution or hiding behavior.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:119:37 new in this release

24 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.80)
```
                            ['4', b'\xe6\xb0\x91\xe7\x94\x9f\xe9\x93\xb6\xe8\xa1\x8c\xe7\x9b\x90\xe5\x9f\x8e\xe5\x88\x86\xe8\xa1\x8c'.decode(), '26200000\n, .', '8850000\n, .', '17350000\n, .', ],
```
likely benign LLM, confidence 0.90 Test fixture row with a UTF-8 Chinese bank branch name as byte escapes.
Reasoning
Same pattern: the byte escapes decode to Chinese bank branch text in a table-parsing test row. This is localized test data, not a payload.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:120:37 new in this release

24 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.80)
```
                            ['5', b'\xe4\xb8\xad\xe4\xbf\xa1\xe9\x93\xb6\xe8\xa1\x8c\xe7\x9b\x90\xe5\x9f\x8e\xe5\x88\x86\xe8\xa1\x8c'.decode(), '20508800\n, .', '20508800\n, .', '000\n.', ],
```
likely benign LLM, confidence 0.90 Test table entry containing Chinese bank text encoded as UTF-8 escapes.
Reasoning
The escapes decode to Chinese text ("中信银行盐城分行") next to numeric strings in a test table. Nothing is executed or decoded to run code.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:121:37 new in this release

24 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.80)
```
                            ['6', b'\xe5\x8d\x97\xe4\xba\xac\xe9\x93\xb6\xe8\xa1\x8c\xe7\x9b\x90\xe5\x9f\x8e\xe5\x88\x86\xe8\xa1\x8c'.decode(), '17517000\n, .', '17517000\n, .', '000\n.', ],
```
likely benign LLM, confidence 0.90 Test fixture row with a Chinese bank name in byte escapes.
Reasoning
The escaped bytes are Chinese bank name text in a test fixture row. The surrounding numeric strings look like table data, consistent with a parser test.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:125:38 new in this release

30 consecutive `\xNN` escapes (entropy 4.3 bits/byte) (raw pass, confidence 0.80)
```
                            ['10', b'\xe6\x81\x92\xe4\xb8\xb0\xe9\x93\xb6\xe8\xa1\x8c\xe5\x8d\x97\xe4\xba\xac\xe6\xb1\x9f\xe5\x8c\x97\xe6\x94\xaf\xe8\xa1\x8c'.decode(), '9390000\n, .', '4350000\n, .', '5040000\n, .', ],
```
likely benign LLM, confidence 0.88 Test fixture with Chinese bank branch names and figures as byte escapes.
Reasoning
The escapes decode to Chinese branch names and numeric table cells. This is expected test data for a table extractor and is not an obfuscated payload.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:126:38 new in this release

24 consecutive `\xNN` escapes (entropy 4.3 bits/byte) (raw pass, confidence 0.80)
```
                            ['11', b'\xe4\xb8\x8a\xe6\xb5\xb7\xe9\x93\xb6\xe8\xa1\x8c\xe7\x9b\x90\xe5\x9f\x8e\xe5\x88\x86\xe8\xa1\x8c'.decode(), '4626500\n, .', '4626500\n, .', '000\n.', ],
                        ],
                    ]
```
likely benign LLM, confidence 0.88 Test fixture row of Chinese bank text and numbers as byte escapes.
Reasoning
Same structure: Chinese bank text with numeric cells encoded as UTF-8 escapes, typical of a localized table test case.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:262:41 new in this release

bytes literal contains 87 `\xNN` escapes (98% of content) — binary payload shape (ast pass, confidence 0.85)
```
                        ['2023', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf
```
likely benign LLM, confidence 0.85 Bytes literal of UTF-8 Chinese disclaimer text used as test expectation data.
Reasoning
The ast payload-bytes-literal flag is triggered by length and escape density, but the bytes decode to valid UTF-8 Chinese prose (credit-risk and rating disclaimers) used as expected test output. This is text fixture data, not a binary payload or dropper.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:262:43 new in this release

27 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.80)
```
                        ['2023', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf
```
likely benign LLM, confidence 0.87 Escaped UTF-8 Chinese text inside a test fixture bytes literal.
Reasoning
The escapes are the same UTF-8 Chinese text as the surrounding bytes literal, a test-data string, with no decoding or execution beyond .decode() comparison.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:262:228 new in this release

21 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
e5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa
```
likely benign LLM, confidence 0.85 Continuation of UTF-8 Chinese text escapes in a test fixture.
Reasoning
The snippet is a continuation of the same UTF-8 Chinese disclaimer text in a test fixture. Escape density is high only because the script is non-ASCII.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:262:313 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
4\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\x
```
likely benign LLM, confidence 0.85 Continuation of UTF-8 Chinese text escapes in a test fixture.
Reasoning
Again UTF-8 Chinese text in a test bytes literal decoded for comparison. The raw encoding signal reflects non-ASCII content, not concealment.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:262:411 new in this release

bytes literal contains 78 `\xNN` escapes (97% of content) — binary payload shape (ast pass, confidence 0.85)
```
\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xb
```
likely benign LLM, confidence 0.85 Long bytes literal of Chinese text in a test fixture, flagged only for its escape density.
Reasoning
The ast flag reflects a long bytes literal, but its content decodes to human-readable Chinese text used as test data. No executable payload or dropper behavior appears.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:262:413 new in this release

18 consecutive `\xNN` escapes (entropy 3.7 bits/byte) (raw pass, confidence 0.65)
```
e5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\
```
dismissed LLM, confidence 0.92 Test fixture encoding Chinese credit-rating text as UTF-8 byte escapes.
Reasoning
The snippet is UTF-8 bytes for Chinese rating-agency text (e.g. 中诚信国际信用评级有限责任公司 and similar phrases) written as \x escapes in a test file. The escapes decode to readable prose, so this is an encoding choice for non-ASCII test data, not hidden code. Raw-pass escape runs are a known false-positive pattern.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:262:487 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\n\xe5\x8f\xb8'.decode(), b'\xe7\xa
```
dismissed LLM, confidence 0.92 Chinese text in a test table written as UTF-8 byte escapes.
Reasoning
Same test fixture: consecutive \x escapes that decode to Chinese financial-disclaimer text, with newlines and ordinary punctuation. Nothing executes the bytes or hides anything; they are compared or decoded as test data.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:262:650 new in this release

18 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.65)
```
e8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\n\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode(), ],
```
dismissed LLM, confidence 0.92 End of a Chinese-text test fixture encoded as byte escapes.
Reasoning
The snippet is the tail of the same test data (a short Chinese word followed by .decode()). It is ordinary localized string data inside a test file.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:263:41 new in this release

bytes literal contains 87 `\xNN` escapes (98% of content) — binary payload shape (ast pass, confidence 0.85)
```
                        ['2022', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf
```
likely benign LLM, confidence 0.88 Bytes literal in a test table row holding UTF-8 encoded Chinese text.
Reasoning
The ast pass labels this a binary payload shape, but the bytes are valid UTF-8 for Chinese text, with spaces and newlines. The bytes sit in a list of table row values in a test file and are only decoded as text. The payload-shape heuristic is a false positive for UTF-8 literals.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:263:43 new in this release

27 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.80)
```
                        ['2022', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf
```
dismissed LLM, confidence 0.92 Long run of UTF-8 byte escapes forming Chinese prose in a test fixture.
Reasoning
Escape soup of UTF-8 Chinese text inside the same test-fixture table. The entropy is typical of multibyte text, and nothing in the snippet executes or conceals code.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:263:228 new in this release

21 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
e5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa
```
dismissed LLM, confidence 0.92 UTF-8 escaped Chinese phrases in a test data row.
Reasoning
Chinese text in UTF-8 escape form, part of the test data alongside the other rows. No decoding into code, no execution, no network use.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:263:313 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
4\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\x
```
dismissed LLM, confidence 0.92 Chinese text encoded as byte escapes in test data.
Reasoning
Another run of UTF-8 escapes that decodes to Chinese disclaimer or rating text. It is consistent with localized test fixtures.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:263:411 new in this release

bytes literal contains 78 `\xNN` escapes (97% of content) — binary payload shape (ast pass, confidence 0.85)
```
\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xb
```
likely benign LLM, confidence 0.88 Bytes literal of Chinese UTF-8 text in a test table, flagged by escape density.
Reasoning
The ast payload-shape flag is triggered by the high share of \x escapes, but the content is UTF-8 Chinese prose. It is a literal in a test table with no execution, decoding into code, or network activity.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:263:413 new in this release

18 consecutive `\xNN` escapes (entropy 3.7 bits/byte) (raw pass, confidence 0.65)
```
e5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe4\xb8\xad\xe8\xaf\x9a\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\
```
dismissed LLM, confidence 0.92 UTF-8 Chinese text as byte escapes in a test fixture.
Reasoning
Same pattern: UTF-8 bytes for Chinese text in a test fixture, with no executable or obfuscated behaviour.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:263:487 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
\xe4\xbf\xa1\xe5\x9b\xbd\xe9\x99\x85\xe4\xbf\xa1\n\xe7\x94\xa8\xe8\xaf\x84\xe7\xba\xa7\xe6\x9c\x89\xe9\x99\x90\xe8\xb4\xa3\n\xe4\xbb\xbb\xe5\x85\xac\xe5\x8f\xb8 \xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\n\xe5\x8f\xb8'.decode(), b'\xe7\xa
```
dismissed LLM, confidence 0.92 Chinese disclaimer text encoded as UTF-8 escapes in test data.
Reasoning
UTF-8 escaped Chinese disclaimer-style text in a test file. It is literal test data that decodes to readable text.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:263:650 new in this release

18 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.65)
```
e8\x81\x94\xe5\x90\x88\xe8\xb5\x84\n\xe3\x80\x81\n\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\n\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode(), ],
```
dismissed LLM, confidence 0.92 Tail of a UTF-8 Chinese text fixture in a test file.
Reasoning
Fragment of the same UTF-8 Chinese fixture ending in a short word and .decode(). It is localized string data, not a payload.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:264:41 new in this release

bytes literal contains 87 `\xNN` escapes (98% of content) — binary payload shape (ast pass, confidence 0.85)
```
                        ['2021', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf
```
likely benign LLM, confidence 0.93 A test fixture row holding Chinese table text written as UTF-8 bytes literals decoded with .decode().
Reasoning
The bytes literal is UTF-8 encoded Chinese prose (financial risk and guarantee text) passed to .decode() in a test fixture. The high escape density is just how non-ASCII text is written in a bytes literal, not a binary payload. The payload-shape heuristic misfires here.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:264:43 new in this release

27 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.80)
```
                        ['2021', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf
```
likely benign LLM, confidence 0.93 UTF-8 escape sequences encoding Chinese text in a test data literal.
Reasoning
The run of \xNN escapes is the UTF-8 encoding of Chinese characters inside a bytes literal that is immediately decoded. Raw-pass escape-soup flags are expected for CJK text and nothing here executes or hides anything.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:264:228 new in this release

21 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
e5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x8
```
likely benign LLM, confidence 0.93 Further UTF-8 byte escapes for Chinese company and rating text in the same fixture.
Reasoning
Consecutive \xNN escapes are UTF-8 bytes for Chinese words such as 联合资信评估 and 有限公司, followed by .decode(). This is ordinary internationalized test data.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:264:313 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
4\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode()
```
likely benign LLM, confidence 0.93 UTF-8 byte literals of Chinese text in a test table fixture.
Reasoning
Same pattern: the escapes encode Chinese text decoded with .decode(). Nothing in the snippet is executed, decoded into code, or sent anywhere.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:264:413 new in this release

18 consecutive `\xNN` escapes (entropy 3.7 bits/byte) (raw pass, confidence 0.65)
```
e5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode(), ],
```
likely benign LLM, confidence 0.93 Trailing UTF-8 byte literals of Chinese text closing a test data list.
Reasoning
The escapes are UTF-8 for Chinese strings such as 稳定 and 联合资信评估有限公司, decoded to text in a list literal of test rows. This is benign localized data.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:265:41 new in this release

bytes literal contains 87 `\xNN` escapes (98% of content) — binary payload shape (ast pass, confidence 0.85)
```
                        ['2020', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf
```
likely benign LLM, confidence 0.93 A second-year test fixture row with Chinese text as UTF-8 bytes literals.
Reasoning
This mirrors line 264: a bytes literal of UTF-8 Chinese prose in a test fixture, decoded immediately. The 98% escape ratio reflects CJK text, not a payload.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:265:43 new in this release

27 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.80)
```
                        ['2020', 'AA+', b'\xe5\x81\xbf\xe8\xbf\x98\xe5\x80\xba\xe5\x8a\xa1\xe7\x9a\x84\xe8\x83\xbd\xe5\x8a\x9b\xe5\xbe\x88\xe5\xbc\xba \xe5\x8f\x97\xe4\xb8\x8d\xe5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf
```
likely benign LLM, confidence 0.93 UTF-8 escape sequences for Chinese text in a test data row.
Reasoning
The escape run encodes Chinese characters for a test fixture that is decoded to str. It is an expected raw-pass hit on non-ASCII text.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:265:228 new in this release

21 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
e5\x88\xa9\xe7\xbb\x8f\xe6\xb5\x8e\n\xef\xbc\x8c\n\xe7\x8e\xaf\xe5\xa2\x83\xe7\x9a\x84\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x8
```
likely benign LLM, confidence 0.93 UTF-8 byte escapes for Chinese text in the same fixture row.
Reasoning
Consecutive escapes are UTF-8 bytes for Chinese words and decode to plain text in a test fixture. No execution or obfuscated logic is present.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:265:313 new in this release

18 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
4\xe5\xbd\xb1\xe5\x93\x8d\xe4\xb8\x8d\xe5\xa4\xa7 \xe8\xbf\x9d\xe7\xba\xa6\xe9\xa3\x8e\xe9\x99\xa9\xe5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode()
```
likely benign LLM, confidence 0.93 Further UTF-8 byte literals of Chinese text in a test fixture.
Reasoning
Chinese text encoded as UTF-8 bytes and decoded with .decode() in a test table. The raw entropy and escape-count flags reflect the multibyte encoding.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:265:413 new in this release

18 consecutive `\xNN` escapes (entropy 3.7 bits/byte) (raw pass, confidence 0.65)
```
e5\xbe\x88\xe4\xbd\x8e\n\xef\xbc\x8c'.decode(), b'\xe8\x81\x94\xe5\x90\x88\xe8\xb5\x84\xe4\xbf\xa1\xe8\xaf\x84\xe4\xbc\xb0\n\xe6\x9c\x89\xe9\x99\x90\xe5\x85\xac\xe5\x8f\xb8'.decode(), b'\xe7\xa8\xb3\xe5\xae\x9a'.decode(), ],
```
likely benign LLM, confidence 0.93 Trailing UTF-8 Chinese byte literals in a test data list.
Reasoning
This is the list-closing part of the fixture: Chinese strings written as UTF-8 bytes and decoded. Benign test data.
info ~~warn~~ → info by review encoding-hex tests/test_tables.py:268:66 new in this release

18 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
         [b'\xe5\xba\x8f\xe5\x8f\xb7'.decode(), b'\xe9\x87\x91\xe8\x9e\x8d\xe6\x9c\xba\xe6\x9e\x84\xe5\x90\x8d\xe7\xa7\xb0'.decode(), b'\xe6\x8e\x88\xe4\xbf\xa1\xe6\x80\xbb\xe9\xa2\x9d'.decode(), b'\xe5\xb7\xb2\xe4\xbd\xbf\xe7\x94\xa8\xe6\x83\x85\xe5\x86\xb5'.decode(), b'\xe5\x89\xa9\xe4\xbd\x99\xe9\xa2\x9d\xe5\xba\xa6
```
likely benign LLM, confidence 0.93 UTF-8 byte literals for Chinese table column headers in a test file.
Reasoning
Each bytes literal is UTF-8 for Chinese column headers such as 序号, 金融机构名称, 授信总额 and 已使用情况, decoded to str. Column-label test data with no code-execution path.
info ~~warn~~ → info by review payload-bytes-literal tests/test_tables.py:270:31 new in this release

bytes literal contains 36 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
```
                        ['2', b'\xe5\xbe\xbd\xe5\x95\x86\xe9\x93\xb6\xe8\xa1\x8c\xe5\x8d\x97\xe4\xba\xac\xe4\xb8\xad\xe5\xb1\xb1\xe5\x8c\x97\xe8\xb7\xaf\xe6\x94\xaf\xe8\xa1\x8c'.decode(), '33043530\n, .', '25673530\n, .', '7370000\n, .', ],
```
dismissed LLM, confidence 0.95 Test fixture encoding Chinese bank names as UTF-8 bytes.
Reasoning
The bytes literal is UTF-8 encoded Chinese bank-branch names immediately decoded with .decode(), in a test fixture. This is ordinary internationalized test data, not a binary payload or dropper.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:270:33 new in this release

36 consecutive `\xNN` escapes (entropy 4.3 bits/byte) (raw pass, confidence 0.80)
```
                        ['2', b'\xe5\xbe\xbd\xe5\x95\x86\xe9\x93\xb6\xe8\xa1\x8c\xe5\x8d\x97\xe4\xba\xac\xe4\xb8\xad\xe5\xb1\xb1\xe5\x8c\x97\xe8\xb7\xaf\xe6\x94\xaf\xe8\xa1\x8c'.decode(), '33043530\n, .', '25673530\n, .', '7370000\n, .', ],
```
dismissed LLM, confidence 0.95 UTF-8 escapes for Chinese text in a table-parsing test.
Reasoning
The consecutive \xNN escapes are the UTF-8 byte sequences of Chinese characters, followed by .decode(). The raw-pass entropy and escape-run signal fires on legitimate multibyte text written as escapes, in a test file.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:271:33 new in this release

24 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.80)
```
                        ['3', b'\xe5\x85\xb4\xe4\xb8\x9a\xe9\x93\xb6\xe8\xa1\x8c\xe7\x9b\x90\xe5\x9f\x8e\xe5\x88\x86\xe8\xa1\x8c'.decode(), '30260000\n, .', '11060000\n, .', '19200000\n, .', ],
```
dismissed LLM, confidence 0.95 UTF-8 escapes for Chinese text in a test table row.
Reasoning
Same pattern: UTF-8 bytes for Chinese bank-name characters decoded in a test. The table rows are expected parser outputs with no execution or network use.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:272:33 new in this release

24 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.80)
```
                        ['4', b'\xe6\xb0\x91\xe7\x94\x9f\xe9\x93\xb6\xe8\xa1\x8c\xe7\x9b\x90\xe5\x9f\x8e\xe5\x88\x86\xe8\xa1\x8c'.decode(), '26200000\n, .', '8850000\n, .', '17350000\n, .', ],
```
dismissed LLM, confidence 0.95 UTF-8 escapes for Chinese text in a test table row.
Reasoning
UTF-8 escapes for Chinese characters decoded to a string used as test expectation data. The raw-pass escape-run signal is a false positive on multibyte text.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:273:33 new in this release

24 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.80)
```
                        ['5', b'\xe4\xb8\xad\xe4\xbf\xa1\xe9\x93\xb6\xe8\xa1\x8c\xe7\x9b\x90\xe5\x9f\x8e\xe5\x88\x86\xe8\xa1\x8c'.decode(), '20508800\n, .', '20508800\n, .', '000\n.', ],
```
dismissed LLM, confidence 0.95 UTF-8 escapes for Chinese text in a test table row.
Reasoning
UTF-8 Chinese text escapes decoded in a test-data row. No code execution or suspicious behavior is present.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:274:33 new in this release

24 consecutive `\xNN` escapes (entropy 4.1 bits/byte) (raw pass, confidence 0.80)
```
                        ['6', b'\xe5\x8d\x97\xe4\xba\xac\xe9\x93\xb6\xe8\xa1\x8c\xe7\x9b\x90\xe5\x9f\x8e\xe5\x88\x86\xe8\xa1\x8c'.decode(), '17517000\n, .', '17517000\n, .', '000\n.', ],
```
dismissed LLM, confidence 0.95 UTF-8 escapes for Chinese text in a test table row.
Reasoning
UTF-8 Chinese text escapes decoded to a string in a test table. The entropy reading comes from non-ASCII text, not obfuscation.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:278:34 new in this release

30 consecutive `\xNN` escapes (entropy 4.3 bits/byte) (raw pass, confidence 0.80)
```
                        ['10', b'\xe6\x81\x92\xe4\xb8\xb0\xe9\x93\xb6\xe8\xa1\x8c\xe5\x8d\x97\xe4\xba\xac\xe6\xb1\x9f\xe5\x8c\x97\xe6\x94\xaf\xe8\xa1\x8c'.decode(), '9390000\n, .', '4350000\n, .', '5040000\n, .', ],
```
dismissed LLM, confidence 0.95 UTF-8 escapes for Chinese text in a test table row.
Reasoning
UTF-8 escapes for Chinese characters decoded in a test fixture, matching the rest of the table data in the same file.
info ~~warn~~ → info by review encoding-escape-soup tests/test_tables.py:279:34 new in this release

24 consecutive `\xNN` escapes (entropy 4.3 bits/byte) (raw pass, confidence 0.80)
```
                        ['11', b'\xe4\xb8\x8a\xe6\xb5\xb7\xe9\x93\xb6\xe8\xa1\x8c\xe7\x9b\x90\xe5\x9f\x8e\xe5\x88\x86\xe8\xa1\x8c'.decode(), '4626500\n, .', '4626500\n, .', '000\n.', ],
                    ],
                ]
```
dismissed LLM, confidence 0.95 UTF-8 escapes for Chinese text in a test table row.
Reasoning
UTF-8 escapes for Chinese characters decoded in a test fixture. The surrounding rows are the same kind of expected parser output.

info high-complexity tests/test_tables.py:1117:19 new in this release

compression ratio 0.573 is >2σ above file mean 0.436 (raw pass, confidence 0.50)

        text = """|Column 1|Column 2|Column 3|\n|---|---|---|\n|Zelle (0,0)|**Bold (0,1)**|Zelle (0,2)|\n|~~Strikeout (1,0), Zeile 1~~<br>~~Hier kommt Zeile 2.~~|Zelle (1,1)|~~Strikeout (1,2)~~|\n|**`Bold-monospaced`**<br>**`(2,0)`**|_Italic (2,1)_|**_Bold-italic_**<br>**_(2,2)_**|\n|Zelle (3,0)|~~**Bold-strikeout**~~<

info ~~critical~~ → info by review dynamic-execution setup.py:1046:9

`subprocess.run` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
        log( f'Building MuPDF by running: {command}')
        subprocess.run( command, shell=True, check=True)
        log( f'Finished building mupdf.')
    
```
likely benign LLM, confidence 0.90 A build helper runs the MuPDF build command through a shell.
Reasoning
This is the MuPDF build step in PyMuPDF's setup.py. The command is assembled from build configuration and logged before running, which is ordinary build tooling. The shell=True call is a legitimate pattern here, though it is a supply-chain-relevant surface.
info ~~critical~~ → info by review dynamic-execution setup.py:1218:9

`subprocess.run` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
        log( f'Building MuPDF by running: {command}')
        subprocess.run( command, shell=True, check=True)
        log( f'Finished building mupdf.')
    
```
likely benign LLM, confidence 0.90 A second MuPDF build invocation through a shell in setup.py.
Reasoning
The snippet duplicates the MuPDF build invocation at line 1046, with the same logging and check=True handling. It is the same legitimate build step, not runtime-injected code.
info ~~warn~~ → info by review frame-introspection src/__init__.py:248:17

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        stack = inspect.stack(context=0)
    except StopIteration:
        pass
```
likely benign LLM, confidence 0.80 The package calls inspect.stack to read the call stack.
Reasoning
inspect.stack is used in a library package to determine caller context, typically for logging or diagnostics. Nothing in the snippet suggests malicious use of frame introspection.

info long-line tests/resources/simple_toc.txt:1:1

line length 1651 characters (raw pass, confidence 0.50)

[1, 'HAUPTÜBERSICHT', -1][1, 'Januar 01/2006', -1][2, 'SPEKTROGRAMM', -1][3, 'Urzeit-Godzilla', -1][3, 'Frühchristliche Mosaike im Knast', -1][3, 'Evolution auf Eis', -1][3, 'Entwarnung bei Kondensstreifen', -1][3, 'Spermatausch beim Schnecken-Sex', -1][3, 'Mehr Monde für Pluto', -1][3, 'Endlich ein Malaria-Impfstof

info long-line tests/test_geometry.py:342:1

line length 558 characters (raw pass, confidence 0.50)

    b = {'number': 0, 'type': 0, 'bbox': (403.3577880859375, 330.8871765136719, 541.2731323242188, 349.5766296386719), 'lines': [{'spans': [{'size': 14.0, 'flags': 4, 'font': 'SFHello-Medium', 'color': 1907995, 'ascender': 1.07373046875, 'descender': -0.26123046875, 'text': 'Inclusion and diversity', 'origin': (403.357

info ~~warn~~ → info by review dynamic-execution tests/test_story.py:120:22

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        '''
        fit_result = eval(call)
        
        print(f'test_fit_springer(): {call=} => {fit_result=}.')
```
likely benign LLM, confidence 0.80 A test evaluates a constructed call expression with eval.
Reasoning
This is a test file evaluating a call expression built from a triple-quoted string of test cases. eval is used on test-authored inputs, not on external or network-supplied data.

info high-complexity tests/test_textextract.py:893:25

compression ratio 0.747 is >2σ above file mean 0.490 (raw pass, confidence 0.50)

    expected_1_23_5 = b'JOB No.: \nShipper (complete name and address) \xe5\x8f\x91\xe8\xb4\xa7\xe4\xba\xba(\xe5\x90\x8d\xe7\xa7\xb0\xe5\x8f\x8a\xe5\x9c\xb0\n\xe5\x9d\x80) \nSINORICH TRANSPORT LIMITED\nADD:7C,WEST BLDG.,ZHONGQU\nMANSION,211 ZHONGSHAN\nRD. SHANTOU,515041 CN\nTEL:0754-88570001 FAX:0754-88572709\nS/O No.

info ~~warn~~ → info by review payload-bytes-literal tests/test_textextract.py:896:29

bytes literal contains 57 `\xNN` escapes (55% of content) — binary payload shape (ast pass, confidence 0.85)
```
    expected_mupdf_1_26_1 = b'JOB No.: Shipper (complete name and address) \xe5\x8f\x91\xe8\xb4\xa7\xe4\xba\xba(\xe5\x90\x8d\xe7\xa7\xb0\xe5\x8f\x8a\xe5\x9c\xb0\xe5\x9d\x80)  Tel:                                  Fax: \n \nS/O No. \xe6\x89\x98\xe8\xbf\x90\xe5\x8d\x95\xe5\x8f\xb7\xe7\xa0\x81     \nSINORICH TRANSPORT LIM
```
dismissed LLM, confidence 0.95 Expected-output fixture of UTF-8 Chinese shipping-order text for a text-extraction test.
Reasoning
A bytes literal of UTF-8 Chinese shipping-order text used as expected output for a text-extraction test that compares against MuPDF. It is expected text, not a payload; the bytes are visible readable content.
info ~~warn~~ → info by review payload-bytes-literal tests/test_textextract.py:899:29

bytes literal contains 51 `\xNN` escapes (51% of content) — binary payload shape (ast pass, confidence 0.85)
```
    expected_mupdf_1_27_0 = b'JOB No.: \n \nS/O No. \xe6\x89\x98\xe8\xbf\x90\xe5\x8d\x95\xe5\x8f\xb7\xe7\xa0\x81   \nSINORICH TRANSPORT LIMITED \nSHIPPING ORDER \n\xe6\x89\x98\xe8\xbf\x90\xe5\x8d\x95 \n \xe5\xb8\x82\xe5\x9c\xba\xe9\x83\xa8: \n88570009 \n88577019 \n88572702 \n \xe6\x93\x8d\xe4\xbd\x9c\xe9\x83\xa8: \n885
```
dismissed LLM, confidence 0.95 Expected-output fixture of UTF-8 Chinese shipping-document text for a text-extraction test.
Reasoning
Another expected-output bytes fixture of UTF-8 Chinese and ASCII shipping-document text for a MuPDF comparison test. It is readable document content with no executable or network behavior.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o pymupdf-2.0.tar.gz https://files.pythonhosted.org/packages/b0/23/3575cf6652171bba33fd4b41d34ab92c7ee75bb5e5790f5a2a044b9ba49b/pymupdf-2.0.tar.gz
printf '%s  %s\n' 7733136f626fffe98677daa53c906eb45f2eb486a6450dbcfd652cbbd760f1e2 pymupdf-2.0.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf pymupdf-2.0.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg