PyPI / six / 1.17.0

six 1.17.0

Source

https://github.com/benjaminp/six

Artifact scanned

six-1.17.0-py2.py3-none-any.whl (wheel · 10.8 KB · SHA-256 4721f391ed90…)

Compared with

six-1.16.0-py2.py3-none-any.whl (0 signals introduced since)

Files

2 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-22 23:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import six.py:87:5

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       """Import module, returning the module after the last dot."""
       __import__(name)
       return sys.modules[name]

   likely benign LLM, confidence 0.95 Dynamic module import helper in the six compatibility library.

   Reasoning

   This is the standard six.py import_module helper: __import__(name) followed by returning sys.modules[name]. The name is a caller-supplied module path, which is the normal purpose of the function. The file is the well-known six compatibility library, so the dynamic import is a legitimate pattern rather than a dropper or evasion.

2. info critical → info by review frame-introspection six.py:733:21

   `sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)

           if _globs_ is None:
               frame = sys._getframe(1)
               _globs_ = frame.f_globals
               if _locs_ is None:

   likely benign LLM, confidence 0.93 Caller frame globals lookup in six's exec_ compatibility shim.

   Reasoning

   This is the exec_ shim in six.py that uses sys._getframe(1) to fetch the caller's globals and locals when none are passed. That is the canonical way six implements exec_ on Python 2. The flag about sys.exit/exec/eval co-occurrence is a generic heuristic that fires on any file containing exec-related code; here it reflects the library's compatibility role, not anti-analysis behavior.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o six-1.17.0-py2.py3-none-any.whl https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl
printf '%s  %s\n' 4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 six-1.17.0-py2.py3-none-any.whl | shasum -a 256 -c -
unzip -q six-1.17.0-py2.py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg