PyPI / websocket-client / 1.9.2

websocket-client 1.9.2

Source

https://github.com/websocket-client/websocket-client

Tag scanned

v1.9.2

Compared with

v1.9.1 (0 signals introduced since)

Files

62 scanned, 11 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 6 info

Scan time

4.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:44

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review frame-introspection websocket/_app.py:586:69

   `inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)

                       debug(
                           f"Calling custom dispatcher reconnect [{len(inspect.stack())} frames in stack]"
                       )
                       assert dispatcher is not None

   likely benign LLM, confidence 0.95 Debug log line reporting the call-stack depth during a websocket reconnect.

   Reasoning

   inspect.stack() is used only to count frames for a debug log message in the websocket-client reconnect logic. It has no execution, network, or evasion role.

2. info warn → info by review frame-introspection websocket/_app.py:605:62

   `inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)

                       debug(
                           f"Calling dispatcher reconnect [{len(inspect.stack())} frames in stack]"
                       )
                       dispatcher.reconnect(reconnect, initialize_socket)

   likely benign LLM, confidence 0.95 Debug log of stack depth before a dispatcher reconnect call.

   Reasoning

   Same pattern: inspect.stack() length is interpolated into a debug message before calling dispatcher.reconnect. Purely diagnostic and consistent with a legitimate library.

3. info warn → info by review frame-introspection websocket/_dispatcher.py:51:69

   `inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)

               info(
                   f"reconnect() - retrying in {seconds} seconds [{len(inspect.stack())} frames in stack]"
               )
               time.sleep(seconds)

   likely benign LLM, confidence 0.95 Info log of stack depth in a reconnect retry message.

   Reasoning

   inspect.stack() counts frames for an info log in the reconnect retry loop of a websocket library. No malicious behavior is present.

4. info warn → info by review decoder-decompress-payload websocket/_wsdump.py:178:44

   file imports decoder module(s) gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

                   try:
                       data = "[gzip] " + str(gzip.decompress(data), "utf-8")
                   except:
                       pass

   likely benign LLM, confidence 0.90 Optional gzip decompression of websocket frame data for display in the wsdump debugging tool.

   Reasoning

   This is the wsdump CLI tool from websocket-client. gzip.decompress is applied inside a try/except to display compressed websocket frame payloads to the user. That is the expected function of a websocket debugging tool, not a hidden runtime payload.

5. info unicode-homoglyph websocket/tests/test_websocket.py:498:32

   identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)

           self.assertEqual(state, True)
           state = validate_utf8("κόσμε")
           self.assertEqual(state, True)
           state = validate_utf8("a\ud800b")

6. info unicode-mixed-script websocket/tests/test_websocket.py:498:32

   identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

           self.assertEqual(state, True)
           state = validate_utf8("κόσμε")
           self.assertEqual(state, True)
           state = validate_utf8("a\ud800b")

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/websocket-client/websocket-client websocket-client && cd websocket-client
git checkout v1.9.2
disclude scan --severity info --diff v1.9.1 .