PyPI / threadpoolctl / 3.7.0

threadpoolctl 3.7.0

Source

https://github.com/joblib/threadpoolctl

Tag scanned

3.7.0

Compared with

3.6.0 (3 signals introduced since)

Files

26 scanned, 7 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

6.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:41

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import continuous_integration/install.sh:50:5 new in this release

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

       # Need to source conda.sh before first conda command
       source "$CONDA/etc/profile.d/conda.sh"
       # prevent mixing conda channels
       conda config --set channel_priority strict

   likely benign LLM, confidence 0.90 CI install script that sources conda's standard profile initialisation script.

   Reasoning

   Sourcing $CONDA/etc/profile.d/conda.sh is the standard way to initialise conda in a CI script. The path is derived from the conda install location, and the comment confirms the intent.

2. info warn → info by review dynamic-import continuous_integration/run_tests.sh:6:5 new in this release

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   if [[ "$PACKAGER" == conda* ]] || [[ -z "$PACKAGER" ]]; then
       source "$CONDA/etc/profile.d/conda.sh"
       conda activate testenv
       conda list

   likely benign LLM, confidence 0.90 Test runner sources conda.sh to activate the testenv environment.

   Reasoning

   Sourcing conda.sh from $CONDA before activating the test environment is ordinary CI setup, with no hidden payload or encoding.

3. info warn → info by review dynamic-import continuous_integration/run_tests.sh:11:5 new in this release

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

       # we actually use conda to install the base environment:
       source "$CONDA/etc/profile.d/conda.sh"
       conda activate testenv
       pip list

   likely benign LLM, confidence 0.90 Test runner sources conda.sh and activates testenv before listing packages.

   Reasoning

   This is the same standard conda.sh sourcing followed by environment activation, consistent with a CI test setup.

4. info critical → info by review dynamic-import benchmarks/bench_context_manager_overhead.py:19:5

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

   for package_name in args.packages:
       __import__(package_name)
   
   pprint(threadpool_info())

   likely benign LLM, confidence 0.80 A benchmark script that imports packages named in its arguments, then reports thread pool info.

   Reasoning

   The loop imports each package named in the script's command-line arguments so their thread pools can be inspected. The import target comes from the user's own CLI input in a benchmark script, not from fetched or obfuscated data, so this looks like a legitimate dynamic-import pattern.

5. info critical → info by review dynamic-execution continuous_integration/install_flexiblas.sh:52:1

   command name is a variable (`$ABS_PATH`) and `ABS_PATH` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

   # Check that all 3 BLAS are listed in FlexiBLAS configuration
   $ABS_PATH/flexiblas_install/bin/flexiblas list
   popd
   popd

   likely benign LLM, confidence 0.85 CI script that runs the locally built flexiblas binary to list configured BLAS backends.

   Reasoning

   ABS_PATH is set from the output of a command, most likely pwd or a resolved path, and is then used to run the FlexiBLAS binary from the locally built install directory. This is a plausible CI check. The rating is critical, but nothing shown is encoded or fetched from outside.

6. info warn → info by review dynamic-execution threadpoolctl.py:1708:9

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

       if options.command:
           exec(options.command)
   
       print(json.dumps(threadpool_info(debugging_info=True), indent=2))

   likely benign LLM, confidence 0.75 CLI debugging option that exec()s a user-supplied command string before printing thread pool info.

   Reasoning

   This is the command-line entry point's `--command` option, which executes a user-supplied string. It is an explicit debugging feature of a local CLI tool and not hidden or obfuscated. It is still arbitrary code execution from input, so it is worth noting, though it is not malicious.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/joblib/threadpoolctl threadpoolctl && cd threadpoolctl
git checkout 3.7.0
disclude scan --severity info --diff 3.6.0 .