websocket-client 1.9.2

Source: https://github.com/websocket-client/websocket-client
Tag scanned: v1.9.2
Compared with: v1.9.1 (0 signals introduced since)
Files: 63 scanned, 10 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 8 info
Scan time: 9.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 04:57

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review unicode-homoglyph compliance/autobahn-test-report-Feb-03-2021.html:3220:224

identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (raw pass, confidence 0.70)
```
 <a class="up" href="#top">Up</a>
 Case Description Send a valid UTF-8 text message in fragments of 1 octet, resulting in frames ending on positions which are not code point ends. MESSAGE: κόσμε cebae1bdb9cf83cebcceb5
```
likely benign LLM, confidence 0.90 A Greek word appearing as UTF-8 test message content in an Autobahn WebSocket compliance report.
Reasoning
The flagged token is the Greek word κόσμε ('world') inside a UTF-8 test-case description in an HTML report. Homoglyph checks fire on natural-language text in a raw pass, which has a high false-positive rate. Nothing here is an identifier or executable code.
info ~~warn~~ → info by review unicode-mixed-script compliance/autobahn-test-report-Feb-03-2021.html:3220:224

identifier `κόσμε` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
 <a class="up" href="#top">Up</a>
 Case Description Send a valid UTF-8 text message in fragments of 1 octet, resulting in frames ending on positions which are not code point ends. MESSAGE: κόσμε cebae1bdb9cf83cebcceb5
```
likely benign LLM, confidence 0.90 The same Greek test-message text, flagged for mixing Greek and Latin scripts.
Reasoning
The mixed-script flag applies to the same Greek text in the HTML body. It is test payload content describing UTF-8 fragmentation, not a code identifier, so mixing scripts here is expected and has no malicious significance.
info ~~warn~~ → info by review frame-introspection websocket/_app.py:586:69

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
                    debug(
                        f"Calling custom dispatcher reconnect [{len(inspect.stack())} frames in stack]"
                    )
                    assert dispatcher is not None
```
likely benign LLM, confidence 0.93 A debug f-string in websocket-client's reconnect logic reports the call-stack depth.
Reasoning
inspect.stack() is used only to count frames for a debug log message in a reconnect path. This is ordinary diagnostic logging in the websocket-client library, not dynamic execution or evasion.
info ~~warn~~ → info by review frame-introspection websocket/_app.py:605:62

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
                    debug(
                        f"Calling dispatcher reconnect [{len(inspect.stack())} frames in stack]"
                    )
                    dispatcher.reconnect(reconnect, initialize_socket)
```
likely benign LLM, confidence 0.93 Another debug log in websocket-client's reconnect path that counts stack frames.
Reasoning
Same pattern as the prior finding: inspect.stack() feeds only the length of a debug message before dispatcher.reconnect is called. Legitimate logging.
info ~~warn~~ → info by review frame-introspection websocket/_dispatcher.py:51:69

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
            info(
                f"reconnect() - retrying in {seconds} seconds [{len(inspect.stack())} frames in stack]"
            )
            time.sleep(seconds)
```
likely benign LLM, confidence 0.93 An info log in the dispatcher's retry loop that reports stack depth.
Reasoning
inspect.stack() length is embedded in an info log before a retry sleep. This is diagnostic output in a reconnect loop with no payload execution or concealment.
info ~~warn~~ → info by review decoder-decompress-payload websocket/_wsdump.py:178:44

file imports decoder module(s) gzip, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
                try:
                    data = "[gzip] " + str(gzip.decompress(data), "utf-8")
                except:
                    pass
```
likely benign LLM, confidence 0.88 The wsdump debugging utility tries to gunzip incoming WebSocket frame data so it can be displayed.
Reasoning
_wsdump is websocket-client's command-line debugging tool. Decompressing gzip frame data inside a try/except to display it is its intended function. The decompressed data is printed, not executed, and the surrounding code is a normal CLI utility.

info unicode-homoglyph websocket/tests/test_websocket.py:498:32

identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)

        self.assertEqual(state, True)
        state = validate_utf8("κόσμε")
        self.assertEqual(state, True)
        state = validate_utf8("a\ud800b")

info unicode-mixed-script websocket/tests/test_websocket.py:498:32

identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

        self.assertEqual(state, True)
        state = validate_utf8("κόσμε")
        self.assertEqual(state, True)
        state = validate_utf8("a\ud800b")

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/websocket-client/websocket-client websocket-client && cd websocket-client
git checkout v1.9.2
disclude scan --severity info --diff v1.9.1 .