PyPI / threadpoolctl / 3.7.0

threadpoolctl 3.7.0

Source

https://github.com/joblib/threadpoolctl

Tag scanned

3.7.0

Compared with

3.6.0 (3 signals introduced since)

Files

26 scanned, 7 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

4.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 04:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import continuous_integration/install.sh:50:5 new in this release

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

       # Need to source conda.sh before first conda command
       source "$CONDA/etc/profile.d/conda.sh"
       # prevent mixing conda channels
       conda config --set channel_priority strict

   likely benign LLM, confidence 0.90 CI install script sourcing conda's profile setup script.

   Reasoning

   Sourcing conda.sh from the CONDA install prefix is the standard way to initialize conda in CI scripts. The dynamic path is a normal environment variable pointing at a known file.

2. info warn → info by review dynamic-import continuous_integration/run_tests.sh:6:5 new in this release

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   if [[ "$PACKAGER" == conda* ]] || [[ -z "$PACKAGER" ]]; then
       source "$CONDA/etc/profile.d/conda.sh"
       conda activate testenv
       conda list

   likely benign LLM, confidence 0.90 Test runner sourcing conda.sh to activate a test environment.

   Reasoning

   Standard conda activation in a test runner: sources conda.sh from $CONDA then activates the test environment. Common and benign.

3. info warn → info by review dynamic-import continuous_integration/run_tests.sh:11:5 new in this release

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

       # we actually use conda to install the base environment:
       source "$CONDA/etc/profile.d/conda.sh"
       conda activate testenv
       pip list

   likely benign LLM, confidence 0.90 Test runner sourcing conda.sh again before activating testenv.

   Reasoning

   Same conda initialization pattern as the earlier line in this test runner; benign environment setup.

4. info critical → info by review dynamic-import benchmarks/bench_context_manager_overhead.py:19:5

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

   for package_name in args.packages:
       __import__(package_name)
   
   pprint(threadpool_info())

   likely benign LLM, confidence 0.80 Benchmark script that dynamically imports user-specified packages from CLI args.

   Reasoning

   A benchmark script imports packages named in command-line arguments so their thread pools can be loaded; the dynamic import is driven by the developer's own CLI input, not hidden or encoded content. Plausible legitimate use, though it does import arbitrary user-named modules.

5. info critical → info by review dynamic-execution continuous_integration/install_flexiblas.sh:52:1

   command name is a variable (`$ABS_PATH`) and `ABS_PATH` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

   # Check that all 3 BLAS are listed in FlexiBLAS configuration
   $ABS_PATH/flexiblas_install/bin/flexiblas list
   popd
   popd

   likely benign LLM, confidence 0.90 CI script invoking a locally built flexiblas binary via a computed path.

   Reasoning

   ABS_PATH is set from the script's own working directory to locate the locally built flexiblas binary and then listing its configuration. This is a routine CI verification step, not a hidden payload or download-and-execute chain.

6. info warn → info by review dynamic-execution threadpoolctl.py:1708:9

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

       if options.command:
           exec(options.command)
   
       print(json.dumps(threadpool_info(debugging_info=True), indent=2))

   likely benign LLM, confidence 0.85 CLI debugging helper that execs a user-supplied command string.

   Reasoning

   This is the __main__ CLI of threadpoolctl, where exec runs a command supplied via the --command option by the user running the tool. It is a debugging feature of a local utility, not obfuscation, though exec of arbitrary input is a risky pattern in general.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/joblib/threadpoolctl threadpoolctl && cd threadpoolctl
git checkout 3.7.0
disclude scan --severity info --diff 3.6.0 .