threadpoolctl 3.7.0

Source: https://github.com/joblib/threadpoolctl
Artifact scanned: threadpoolctl-3.7.0-py3-none-any.whl (wheel · 25.7 KB · SHA-256 cd8b60b5641b…)
Compared with: threadpoolctl-3.6.0-py3-none-any.whl (0 signals introduced since)
Files: 1 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 3.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 07:22

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution threadpoolctl.py:1708:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    if options.command:
        exec(options.command)

    print(json.dumps(threadpool_info(debugging_info=True), indent=2))
```
likely benign LLM, confidence 0.80 A __main__ block in threadpoolctl.py calls exec on a command option, then prints thread pool debugging info as JSON.
Reasoning
The exec call runs options.command, which appears to come from the script's own command-line argument parsing, and the block then prints threadpool_info as JSON. That fits a developer debugging CLI that intentionally runs user-supplied code, not an obfuscated or hidden payload. The finding is a real dynamic-execution pattern, but nothing in the snippet shows data fetched from an untrusted source, encoding, or a dropper. The main doubt is that the argument source is not shown, so it is not fully verified.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o threadpoolctl-3.7.0-py3-none-any.whl https://files.pythonhosted.org/packages/43/3f/f88a53f60a472b46f4023f56d204dd7de33d34c5d2acbfa0d70a674e639e/threadpoolctl-3.7.0-py3-none-any.whl
printf '%s  %s\n' cd8b60b5641b45c67bbf73c64c843235fc2d8a480c87389f52f5dbee893b86be threadpoolctl-3.7.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q threadpoolctl-3.7.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg