PyPI / typing-extensions / 4.16.0

typing-extensions 4.16.0

Source

https://github.com/python/typing_extensions

Artifact scanned

typing_extensions-4.16.0-py3-none-any.whl (wheel · 44.5 KB · SHA-256 481caa481374…)

Compared with

typing_extensions-4.15.0-py3-none-any.whl (1 signals introduced since)

Files

1 scanned, 4 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-22 23:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review frame-introspection typing_extensions.py:170:16 new in this release

   `sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)

       try:
           return sys._getframe(depth + 1).f_globals.get('__name__', default)
       except (AttributeError, ValueError):  # For platforms without _getframe()
           pass

   likely benign LLM, confidence 0.93 Caller-module lookup via sys._getframe in the typing_extensions library, guarded for platforms without it.

   Reasoning

   sys._getframe usage in typing_extensions' sys_getframe-based helper to determine module name (caller's __name__) is a standard, documented pattern in the typing_extensions library. The try/except for AttributeError/ValueError is explicitly for platforms lacking _getframe. The 'anti-analysis' co-occurrence heuristic is weak here; this is a well-known legitimate library file.

2. info critical → info by review frame-introspection typing_extensions.py:3283:17

   `sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)

       try:
           frame = sys._getframe(2)
       # - Catch AttributeError: not all Python implementations have sys._getframe()
       # - Catch ValueError: maybe we're called from an unexpected module

   likely benign LLM, confidence 0.93 Caller frame retrieval with explicit fallback handling in typing_extensions.

   Reasoning

   Snippet shows sys._getframe(2) wrapped in try/except with comments explaining platform and unexpected-module fallbacks. This is the standard caller-frame lookup in typing_extensions (e.g. for NamedTuple/TypedDict module detection), not anti-analysis behavior.

3. info warn → info by review dynamic-execution typing_extensions.py:4172:54

   `eval` called on a non-literal expression (ast pass, confidence 0.70)

           return_value = {key:
               value if not isinstance(value, str) else eval(value, globals, locals)
               for key, value in ann.items() }
           return return_value

   likely benign LLM, confidence 0.85 eval of string annotations when resolving type hints in typing_extensions.

   Reasoning

   eval is applied to string annotation values inside get_type_hints-style evaluation of forward references, which is the documented behavior of typing annotation resolution. Input is developer-supplied annotations, not network or attacker data. Legitimate in this library context, though eval is inherently a dynamic-execution sink.

4. info warn → info by review dynamic-execution typing_extensions.py:4254:21

   `eval` called on a non-literal expression (ast pass, confidence 0.70)

               code = forward_ref.__forward_code__
               value = eval(code, globals, locals)
           forward_ref.__forward_evaluated__ = True
           forward_ref.__forward_value__ = value

   likely benign LLM, confidence 0.85 Evaluation of ForwardRef code objects to resolve type annotations in typing_extensions.

   Reasoning

   eval of a compiled forward-reference code object during ForwardRef evaluation, mirroring the standard typing module. The code originates from annotation strings in source, consistent with legitimate typing behavior.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o typing_extensions-4.16.0-py3-none-any.whl https://files.pythonhosted.org/packages/49/d3/b8441a820a491ddfc024b0b0cf0393375b75ea13866d9c66727e54c2fc80/typing_extensions-4.16.0-py3-none-any.whl
printf '%s  %s\n' 481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 typing_extensions-4.16.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q typing_extensions-4.16.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg