PyPI / six / 1.17.0

six 1.17.0

Source

https://github.com/benjaminp/six

Tag scanned

1.17.0

Compared with

1.16.0 (0 signals introduced since)

Files

6 scanned, 7 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

5.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import six.py:87:5

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       """Import module, returning the module after the last dot."""
       __import__(name)
       return sys.modules[name]

   dismissed LLM, confidence 0.95 Generic dynamic-import helper in the six compatibility library that imports a module by name and returns it.

   Reasoning

   The snippet is the body of six's `_import_module` helper, a standard compatibility function that imports a module by name and returns it from sys.modules. The name comes from library callers, not untrusted input, and the code is a well-known, widely vendored pattern. The finding is a false positive.

2. info critical → info by review frame-introspection six.py:733:21

   `sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)

           if _globs_ is None:
               frame = sys._getframe(1)
               _globs_ = frame.f_globals
               if _locs_ is None:

   dismissed LLM, confidence 0.90 Caller-frame lookup in six's exec compatibility shim to obtain default globals.

   Reasoning

   The snippet is from six's `exec_` shim, which uses sys._getframe(1) to default the caller's globals and locals when none are passed. This is a legitimate Python 2/3 compatibility idiom. The anti-analysis shape flagged by the scanner comes from the co-located exec call in the same compatibility file, not from evasive behavior.

3. info critical → info by review dynamic-import test_six.py:132:13

   `__import__` called on a non-literal expression (ast pass, confidence 0.90)

           if isinstance(item, types.ModuleType):
               __import__("six.moves." + item_name)
       except ImportError:
           if item_name == "winreg" and not sys.platform.startswith("win"):

   dismissed LLM, confidence 0.92 Test-suite import of a six.moves submodule by constructed name, guarded by ImportError handling.

   Reasoning

   The snippet is from six's test suite, where lazy-moved modules are imported as `six.moves.<name>` inside a try/except ImportError block that handles platform-specific modules such as winreg. The argument is a constant prefix plus test-controlled names, so there is no malicious indicator.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/benjaminp/six six && cd six
git checkout 1.17.0
disclude scan --severity info --diff 1.16.0 .