six 1.17.0

Source: https://github.com/benjaminp/six
Tag scanned: 1.17.0
Compared with: 1.16.0 (0 signals introduced since)
Files: 6 scanned, 7 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 3.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 20:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-import six.py:87:5

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    """Import module, returning the module after the last dot."""
    __import__(name)
    return sys.modules[name]
```
likely benign LLM, confidence 0.97 Standard dynamic module import helper inside the six compatibility library.
Reasoning
This is the well-known import_module helper from the six compatibility library. The __import__ call on a parameter is the standard way to import a module by name, and the next line returns sys.modules[name]. The docstring and surrounding code match the upstream library exactly, so this is a legitimate dynamic import, not obfuscation.
info ~~critical~~ → info by review frame-introspection six.py:733:21

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
        if _globs_ is None:
            frame = sys._getframe(1)
            _globs_ = frame.f_globals
            if _locs_ is None:
```
likely benign LLM, confidence 0.95 Caller-frame globals lookup used as the default namespace for the exec_ compatibility shim in six.
Reasoning
This is the exec_ fallback in six that uses sys._getframe(1) to obtain the caller's globals when none are supplied. It is a documented, longstanding pattern in the six library for emulating exec's default namespace. The 'anti-analysis' co-occurrence flag is a generic heuristic that does not fit this compatibility shim.
info ~~critical~~ → info by review dynamic-import test_six.py:132:13

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
        if isinstance(item, types.ModuleType):
            __import__("six.moves." + item_name)
    except ImportError:
        if item_name == "winreg" and not sys.platform.startswith("win"):
```
likely benign LLM, confidence 0.96 Test-suite code that imports six.moves submodules by constructed name, handling platform-specific ImportError.
Reasoning
This is in the six test suite, which lazily imports moved modules by constructed name such as 'six.moves.' plus an item name, catching ImportError for platform-specific modules like winreg. The construction is a test of the lazy-loader behavior, with the name coming from a fixed list of known modules, so it is not malicious.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/benjaminp/six six && cd six
git checkout 1.17.0
disclude scan --severity info --diff 1.16.0 .